Issue name

CSS injection (stored)

Typical severity

Medium

Issue description

CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL, or embeds user input in CSS blocks without adequate escaping. They are closely related to cross-site scripting (XSS) vulnerabilities but often trickier to exploit.

Being able to inject arbitrary CSS into the victim's browser may enable various attacks, including:

Stored CSS injection vulnerabilities arise when the applicable input was submitted in an previous request and stored by the application.

Issue remediation

Ensure that user input is adequately escaped before embedding it in CSS blocks, and consider using a whitelist to prevent loading of arbitrary style sheets.

References

Vulnerability classifications