---
id: 4060
title: "LEXSS: Bypassing Lexical Parsing Security Controls"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/lexss-bypassing-lexical-parsing-security-controls"
published_at: "2021-06-22T00:00:00Z"
tags: ["web-security", "xss", "vulnerability", "parsing", "sanitization", "lexss"]
phying_url: "https://phying.com/item/4060"
lang: en
---

# LEXSS: Bypassing Lexical Parsing Security Controls

## Summary

Introducing LEXSS: XSS that bypasses lexical sanitizers by abusing mismatches between HTML parsing and lexical parsing, letting special HTML tags run JavaScript where filters were believed effective.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2021-06-22T00:00:00Z
- **Original:** https://bishopfox.com/blog/lexss-bypassing-lexical-parsing-security-controls
- **Phying News:** https://phying.com/item/4060