Markdown Rendering Injection Lab: XSS Through an AI Chatbot

This article describes a security lab demonstrating XSS vulnerability in AI chatbot interfaces that render Markdown output. The vulnerability arises not from the language model itself, but from unsafe rendering of model output in the web page: a naive Markdown-to-HTML converter fails to properly quote URLs in image tags, creating an attack surface. The lab teaches that LLM output must be treated as untrusted input and that security relies on the display layer, not the model's filtering.

• Markdown image syntax becomes XSS vectorDocBot filters raw HTML but allows Markdown image syntax  because developers believed images are not executable. However, when the renderer converts this to an HTML img tag without properly quoting the URL attribute, an attacker can craft a Markdown image whose URL parameter closes the src attribute early, injects an onerror handler, and reopens a harmless attribute to keep the tag valid.
• LLM becomes reliable payload delivery mechanismThe model is not itself vulnerable but acts as a faithful payload generator. By requesting the model show Markdown syntax for an image with a specific URL (framed as a formatting question), the model outputs the attacker-supplied string verbatim because it is being accurate and helpful. The model's output filter considers Markdown safe and does not block it, making the model a dependable channel to get hostile input into the renderer.
• Onerror handler executes on broken imagesWhen an img tag points to an invalid or unreachable URL, the browser fires the onerror event handler. An attacker pointing the image source to a malformed value guarantees the handler fires, executing whatever JavaScript the attacker has injected into the onerror attribute.
• Defense-in-depth requires multiple layersThe article recommends sanitizing rendered HTML after Markdown conversion using tools like DOMPurify, using a strict renderer with disabled HTML and escaped URLs, adding Content Security Policy to block inline event handlers, and optionally rendering chat in a sandboxed iframe. No single layer is sufficient; CSP alone is not enough because DOMPurify may miss edge cases, and a good renderer alone does not protect against converter bugs.
• Two systems each assumed the other was safeThe vulnerability exists because the model's filter trusted Markdown as harmless output and the Markdown renderer trusted the model would never emit hostile input. This shared false assumption created the bug: neither system validated or sanitized, each relying on the other to enforce security.
• Markdown renderers enable data exfiltrationResearcher Johann Rehberger demonstrated in 2023 that chat interfaces rendering Markdown could be induced to load an attacker-controlled URL with conversation data in the query string, silently leaking sensitive information. This prompted some vendors to restrict image rendering in chat.
• Model output is untrusted front-end inputThe core principle is that LLM output must be treated exactly like any user-supplied input: sanitized after rendering, every time. The model is not the vulnerability; the page that trusts its output without proper validation is.

Bottom line: XSS in AI chatbot interfaces exploits unsafe Markdown rendering, not the model itself—treat model output as untrusted input and sanitize after conversion using multiple defense layers including DOMPurify, strict renderers, CSP, and sandboxing. This is a real vulnerability in production AI products requiring proper disclosure and remediation.