DOJO Challenge #25 Winners!

This write-up documents a proof-of-concept CSS injection that enables stored XSS: by importing an attacker-controlled stylesheet the author injects a CSS variable containing an HTML payload which client-side JavaScript reads via getComputedStyle and inserts into the page, triggering onerror script execution; the report demonstrates the PoC, describes the risk to users and organizations, and recommends mitigations such as input sanitization, Content Security Policy, and HTML sanitization libraries.