Unverified50% confidenceDecision RuleExact time
If model output is rendered as HTML by the application, there is an XSS risk; if it is used to concatenate queries or shell commands, there is an injection risk, so model output should be treated as untrusted user input.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedModel output should never be inserted as raw HTML; it must be treated as untrusted content to guard against injection risks.65% similarUnverifiedReact默认转义JSX中的变量，但dangerouslySetInnerHTML允许开发者绕过这一XSS保护61% similarUnverifiedCross-site scripting (XSS) is the injection of malicious JavaScript into a page; when other users browse that page the script executes in their browser and can steal cookies or session tokens.57% similarUnverifiedThis patch ensures that the additionalProperties: false field in JSON Schema is correctly preserved when passing tool definitions to xAI models.55% similarUnverifiedThe concurrency model of Lambda Web Functions requires the application code to be concurrency-safe and to avoid relying on global mutable state.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1047776API
curl https://kongchang.com/api/v1/knowledge/claims/1047776MCP
get_claim(id=1047776)