Cross-site scripting
XSS (short for Cross-site scripting) is a cyberattack against a web user that exploits a vulnerability in a web application. It allows an attacker to inject a malicious script intended to run in a user's browser and perform actions on the user's behalf on the site.
On this page
Source content checked . English translation published 2026-10-27.
In business automation
XSS can affect automation when customer text is displayed in an internal screen or sent in a message without sanitization. A script in an agent's browser can act on the agent's behalf and change a record or steal a session.
Examples
These examples illustrate a possible workflow. Adapt the connections and rules to your own systems.
Customer comment in a support ticket
A form saves a free-text comment and sends it to an agent's screen. If the comment contains a script tag and the screen displays it as HTML, the agent's browser may run foreign code. Store it as text and display it after encoding.
Relevant tools
- Vercel
- Certain headers can be blocked during deployment, but sanitizing input and output remains the responsibility of the application displaying the text.
What to check
- Encoding one field does not protect another field injected into an HTML email or widget.