cspshivam/playground
AI Sec Level 5 / 10 Hard
← All labs

Unsafe Output Rendering

Replies are painted into the page as HTML. Turn one into cross-site script.

Assistant with rich replies

This chat renders the assistant's answer as formatted HTML so links and styling look nice. The assistant tends to quote what you said. Turn a reply into script execution.

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.