CISA Urges Software Makers to Eliminate XSS Flaws

CISA and the FBI issued a Secure by Design alert urging software makers to eliminate cross-site scripting (XSS) vulnerabilities prior to shipping products, noting XSS remains widespread and preventable. The alert recommends validating and sanitizing inputs, using modern web frameworks with proper output encoding, performing adversarial product testing, and adopting Secure by Design practices promoted by CISA, referencing prior alerts on common vulnerability classes and a vendor pledge to improve security.