# Unescaped HTML injection in renderers

User or page text parsed as HTML in templates, WebViews, or raw-render flags, enabling markup and resource loads

_Area: Web injection and code execution. Seen in 7 disclosed reports; one confirmed bounty: $1,000; latest 2023-06-22. Updated 2026-10-23._

## How it works

A renderer treats attacker-influenced text as HTML instead of text. The broken assumption is that displaying data is passive. In an HTML parsing context, markup is live: tags resolve resource references and can trigger navigation, and the renderer acts with its own origin, credentials, and network position. The root cause is a missing encode-at-sink step, whether the sink is a template placeholder, a WebView load, or a framework's raw-render flag.

## Where it shows up

- Template placeholders filled from page or user data and inserted into HTML/WebView markup: title, author, credits, content [E2](https://bugbountylibrary.com/r/h1%3A1436142.md)[E6](https://bugbountylibrary.com/r/h1%3A991713.md)
- CSP nonces that are literal placeholder strings substituted at render time [E2](https://bugbountylibrary.com/r/h1%3A1436142.md)
- Framework raw-render flags (`html="true"`-style) on attacker-influenced strings: kick reasons, names, chat [E4](https://bugbountylibrary.com/r/h1%3A631956.md)
- Client-side tools (message editors, log viewers, markdown previews) rendering request bodies as HTML [E5](https://bugbountylibrary.com/r/h1%3A1054382.md)
- Sanitizers that strip known-dangerous attributes but leave other data-* attributes that app JS reads to drive requests [E3](https://bugbountylibrary.com/r/h1%3A1409788.md)
- Electron/WebView apps exposing privileged objects (window.desktop, BrowserWindow) to rendered content [E1](https://bugbountylibrary.com/r/h1%3A783877.md)

## How to review

Trace every field from source to HTML sink and confirm it is escaped at the sink. The invariant: no user- or page-controlled string reaches an HTML parsing context without encoding. Grep every template and layout for raw-render flags and placeholders, then cross-reference which render attacker-influenced strings [E4](https://bugbountylibrary.com/r/h1%3A631956.md)[E6](https://bugbountylibrary.com/r/h1%3A991713.md). In templates with a nonce placeholder, check whether any unescaped field rendered after the nonce can forge a matching nonce value [E2](https://bugbountylibrary.com/r/h1%3A1436142.md). For sanitizer-based defenses, audit the app's own JS for data-* attributes that feed fetch/axios calls, not just the attributes the sanitizer blocks [E3](https://bugbountylibrary.com/r/h1%3A1409788.md). For embedded renderers, confirm resource loading is disabled or proxied for untrusted content [E5](https://bugbountylibrary.com/r/h1%3A1054382.md).

## Variants seen

- Unescaped meta author field under relaxed nonce CSP [E2](https://bugbountylibrary.com/r/h1%3A1436142.md)
- Unescaped page title in localhost-served reader view [E6](https://bugbountylibrary.com/r/h1%3A991713.md)
- Raw-render flag on disconnect/kick message in game UI [E4](https://bugbountylibrary.com/r/h1%3A631956.md)
- Client-side HTML rendering auto-fetching img/link, including file:// to SMB, ignoring proxy config [E5](https://bugbountylibrary.com/r/h1%3A1054382.md)
- Injected area/map tags forcing in-app redirect to attacker page that abuses exposed Electron APIs [E1](https://bugbountylibrary.com/r/h1%3A783877.md)
- DOMPurify-preserved data-* attributes hijacking app JS to fire POSTs as victim [E3](https://bugbountylibrary.com/r/h1%3A1409788.md)

## Impact and severity

Led to script execution and cross-origin page theft [E2](https://bugbountylibrary.com/r/h1%3A1436142.md), credential phishing and content exfiltration [E6](https://bugbountylibrary.com/r/h1%3A991713.md), RCE via Electron API abuse [E1](https://bugbountylibrary.com/r/h1%3A783877.md), RCE in a game client [E4](https://bugbountylibrary.com/r/h1%3A631956.md), NetNTLM hash and IP disclosure plus DoS [E5](https://bugbountylibrary.com/r/h1%3A1054382.md), and arbitrary authenticated POSTs including admin creation [E3](https://bugbountylibrary.com/r/h1%3A1409788.md). Severity rises when the renderer holds credentials, sits on an internal network, or exposes privileged APIs to rendered content.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A783877.md
- E2: https://bugbountylibrary.com/r/h1%3A1436142.md
- E3: https://bugbountylibrary.com/r/h1%3A1409788.md
- E4: https://bugbountylibrary.com/r/h1%3A631956.md
- E5: https://bugbountylibrary.com/r/h1%3A1054382.md
- E6: https://bugbountylibrary.com/r/h1%3A991713.md