CWE-82 (Web页面IMG标签属性中脚本转义处理不恰当) — Vulnerability Class 7

CWE-82 represents a critical input validation weakness where web applications fail to properly sanitize scripting elements within HTML IMG tag attributes, such as the src parameter. This vulnerability allows attackers to inject malicious JavaScript code directly into image source URLs, which the browser interprets as executable commands rather than static resources. When a victim loads the compromised page, the embedded script automatically executes in their context, leading to cross-site scripting attacks that can steal session cookies, deface websites, or redirect users to phishing sites. To mitigate this risk, developers must implement rigorous input validation and output encoding strategies. Specifically, they should escape special characters like quotes and angle brackets within attribute values and employ Content Security Policy headers to restrict script execution sources, ensuring that only trusted content runs within the application environment.