Unverified50% confidenceCautionExact time
Disabling thinking causes tool calls to leak into the output as text, and internal XML tags to appear in visible responses (tag leakage).
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
8/29/2026
First Seen
Valid until: 11/27/2026
Sources
Related Entities
Related Claims
UnverifiedinnerHTML carries an XSS risk because it parses the string as HTML and executes any script tags or event handler attributes (such as onerror) within it.63% similarUnverifiedAllowing users to submit rich text content containing HTML markup can lead to XSS (Cross-Site Scripting) attacks, where malicious users can inject script tags to execute arbitrary JavaScript code.63% similarUnverified间接注入攻击手法包括在网页嵌入与背景色相同的隐藏文字、在PDF元数据或注释字段植入越狱指令、利用Markdown语法伪装恶意提示63% similarUnverified社交平台的输入框通常通过监听 paste 事件并调用 event.clipboardData.getData('text/plain') 来剥离富文本标记，只保留纯文本63% similarUnverified.docx文件解压后是由数十个XML文件和资源目录构成的复杂包，document.xml存储正文内容，styles.xml定义样式规则60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/820852API
curl https://kongchang.com/api/v1/knowledge/claims/820852MCP
get_claim(id=820852)