Insecure output handling: LLM response to stored XSS
When an app renders model output as HTML without sanitizing, an attacker who controls part of the prompt gets XSS in the victim's session.
Tag: xss
Client-side prototype pollution to DOM XSS
A polluted prototype property read by a sink like a template loader or script src becomes reliable XSS without any server bug.