CWE-838
AllowedInappropriate Encoding for Output Context
Abstraction: Base · Status: Incomplete
The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
21 vulnerabilities reference this CWE, most recent first.
GHSA-7R4Q-Q89F-2MCG
Vulnerability from github – Published: 2024-11-26 15:31 – Updated: 2024-11-27 18:34Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird < 133.
{
"affected": [],
"aliases": [
"CVE-2024-11702"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T14:15:19Z",
"severity": "HIGH"
},
"details": "Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox \u003c 133 and Thunderbird \u003c 133.",
"id": "GHSA-7r4q-q89f-2mcg",
"modified": "2024-11-27T18:34:03Z",
"published": "2024-11-26T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11702"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1918884"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-63"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-67"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-855X-QR5W-6PWV
Vulnerability from github – Published: 2022-11-23 18:30 – Updated: 2022-11-28 18:30The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users.
{
"affected": [],
"aliases": [
"CVE-2021-35246"
],
"database_specific": {
"cwe_ids": [
"CWE-319",
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-23T17:15:00Z",
"severity": "MODERATE"
},
"details": "The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user\u0027s network traffic could bypass the application\u0027s use of SSL/TLS encryption and use the application as a platform for attacks against its users.",
"id": "GHSA-855x-qr5w-6pwv",
"modified": "2022-11-28T18:30:16Z",
"published": "2022-11-23T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35246"
},
{
"type": "WEB",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htm"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G66M-FQXF-3W35
Vulnerability from github – Published: 2022-10-19 19:00 – Updated: 2022-12-16 17:10Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step (proceed or abort) and is not correctly encoded.
This allows attackers able to configure Pipelines to have Jenkins build URLs from input step IDs that would bypass the CSRF protection of any target URL in Jenkins when the input step is interacted with.
Pipeline: Input Step Plugin 456.vd8a_957db_5b_e9 limits the characters that can be used for the ID of input steps in Pipelines to alphanumeric characters and URL-safe punctuation. Pipelines with input steps having IDs with prohibited characters will fail with an error.
This includes Pipelines that have already been started but not finished before Jenkins is restarted to apply this update.
Pipeline: Declarative Plugin provides an input directive that is internally using the input step, and specifies a non-default ID if not user-defined. Pipeline: Declarative Plugin 2.2114.v2654ca_721309 and earlier may specify values incompatible with this new restriction on legal values: input directives in a stage use the stage name (which may include prohibited characters) and input directives in a matrix will use a value generated from the matrix axis values (which always includes prohibited characters). Administrators are advised to update Pipeline: Input Step Plugin and Pipeline: Declarative Plugin at the same time, ideally while no Pipelines are running.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 456.vd8a"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:pipeline-input-step"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "456.vd8a_957db_5b_e9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43407"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-838"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-19T21:21:29Z",
"nvd_published_at": "2022-10-19T16:15:00Z",
"severity": "HIGH"
},
"details": "Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the `input` step. This ID is used for the URLs that process user interactions for the given `input` step (proceed or abort) and is not correctly encoded.\n\nThis allows attackers able to configure Pipelines to have Jenkins build URLs from `input` step IDs that would bypass the CSRF protection of any target URL in Jenkins when the `input` step is interacted with.\n\nPipeline: Input Step Plugin 456.vd8a_957db_5b_e9 limits the characters that can be used for the ID of `input` steps in Pipelines to alphanumeric characters and URL-safe punctuation. Pipelines with `input` steps having IDs with prohibited characters will fail with an error.\n\nThis includes Pipelines that have already been started but not finished before Jenkins is restarted to apply this update.\n\n[Pipeline: Declarative Plugin](https://plugins.jenkins.io/pipeline-model-definition/) provides an `input` directive that is internally using the `input` step, and specifies a non-default ID if not user-defined. Pipeline: Declarative Plugin 2.2114.v2654ca_721309 and earlier may specify values incompatible with this new restriction on legal values: `input` directives in a `stage` use the stage name (which may include prohibited characters) and `input` directives in a `matrix` will use a value generated from the matrix axis values (which always includes prohibited characters). Administrators are advised to update Pipeline: Input Step Plugin and Pipeline: Declarative Plugin at the same time, ideally while no Pipelines are running.",
"id": "GHSA-g66m-fqxf-3w35",
"modified": "2022-12-16T17:10:18Z",
"published": "2022-10-19T19:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/pipeline-input-step-plugin/commit/d8a957db5be95ddfbf81f41a60b2f034000314b5"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/pipeline-input-step-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin"
}
GHSA-G975-F26H-93G8
Vulnerability from github – Published: 2022-10-19 19:00 – Updated: 2023-10-27 20:58Jenkins Pipeline: Stage View Plugin provides a visualization of Pipeline builds. It also allows users to interact with input steps from Pipeline: Input Step Plugin.
Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of input steps when using it to generate URLs to proceed or abort Pipeline builds.
This allows attackers able to configure Pipelines to specify input step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
Pipeline: Stage View Plugin 2.27 correctly encodes the ID of input steps when using it to generate URLs to proceed or abort Pipeline builds.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view"
},
"ranges": [
{
"events": [
{
"introduced": "2.25"
},
{
"fixed": "2.27"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.24.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43408"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-838"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-19T20:27:47Z",
"nvd_published_at": "2022-10-19T16:15:00Z",
"severity": "HIGH"
},
"details": "Jenkins Pipeline: Stage View Plugin provides a visualization of Pipeline builds. It also allows users to interact with `input` steps from Pipeline: Input Step Plugin.\n\nPipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of `input` steps when using it to generate URLs to proceed or abort Pipeline builds.\n\nThis allows attackers able to configure Pipelines to specify `input` step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.\n\nPipeline: Stage View Plugin 2.27 correctly encodes the ID of `input` steps when using it to generate URLs to proceed or abort Pipeline builds.",
"id": "GHSA-g975-f26h-93g8",
"modified": "2023-10-27T20:58:14Z",
"published": "2022-10-19T19:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/pipeline-stage-view-plugin/commit/cee275109ee748fa9f599ec60159807a28a2933f"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/19/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins"
}
GHSA-JHCF-J4HG-V64R
Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2023-09-26 19:48Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/pimcore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-18981"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-18T22:06:54Z",
"nvd_published_at": "2019-11-15T05:15:00Z",
"severity": "CRITICAL"
},
"details": "Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.",
"id": "GHSA-jhcf-j4hg-v64r",
"modified": "2023-09-26T19:48:39Z",
"published": "2022-05-24T17:01:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18981"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/commit/0a5d80b2593b2ebe35d19756b730ba33aa049106"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pimcore Access Control Issues"
}
GHSA-M37V-MHQJ-22CM
Vulnerability from github – Published: 2023-08-02 00:30 – Updated: 2025-07-09 15:30Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2023-3735"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-01T23:15:32Z",
"severity": "MODERATE"
},
"details": "Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-m37v-mhqj-22cm",
"modified": "2025-07-09T15:30:31Z",
"published": "2023-08-02T00:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3735"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2023/07/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1394410"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-34"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MV2J-4MM8-9XGV
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2025-12-18 15:30In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
{
"affected": [],
"aliases": [
"CVE-2019-6110"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-31T18:29:00Z",
"severity": "MODERATE"
},
"details": "In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.",
"id": "GHSA-mv2j-4mm8-9xgv",
"modified": "2025-12-18T15:30:24Z",
"published": "2022-05-13T01:22:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6110"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
},
{
"type": "WEB",
"url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c"
},
{
"type": "WEB",
"url": "https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201903-16"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190213-0001"
},
{
"type": "WEB",
"url": "https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46193"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q8Q6-CCRM-HRM9
Vulnerability from github – Published: 2024-01-10 00:30 – Updated: 2024-01-10 00:30Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.
{
"affected": [],
"aliases": [
"CVE-2023-5770"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T22:15:43Z",
"severity": "MODERATE"
},
"details": "Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML into the email body of a message through the email subject. The vulnerability is caused by inappropriate encoding when rewriting the email before delivery.This issue affects Proofpoint Enterprise Protection: from 8.20.2 before patch 4809, from 8.20.0 before patch 4805, from 8.18.6 before patch 4804 and all other prior versions.\n\n",
"id": "GHSA-q8q6-ccrm-hrm9",
"modified": "2024-01-10T00:30:21Z",
"published": "2024-01-10T00:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5770"
},
{
"type": "WEB",
"url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VVH5-7V3M-J3MJ
Vulnerability from github – Published: 2024-05-31 21:30 – Updated: 2025-05-15 21:03The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34006"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-04T17:37:34Z",
"nvd_published_at": "2024-05-31T21:15:09Z",
"severity": "MODERATE"
},
"details": "The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.",
"id": "GHSA-vvh5-7v3m-j3mj",
"modified": "2025-05-15T21:03:23Z",
"published": "2024-05-31T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34006"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/cd85e090f3feb06e6eff65d1499a67353d82d3cb"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=458395"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-80585"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle Unsanitized HTML in site log for config_log_created"
}
GHSA-XPC5-66VP-J2WH
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a "docker exec" command with that value in the -u argument, a similar issue to CVE-2016-3697.
{
"affected": [],
"aliases": [
"CVE-2018-9862"
],
"database_specific": {
"cwe_ids": [
"CWE-838"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-09T16:29:00Z",
"severity": "HIGH"
},
"details": "util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a \"docker exec\" command with that value in the -u argument, a similar issue to CVE-2016-3697.",
"id": "GHSA-xpc5-66vp-j2wh",
"modified": "2022-05-13T01:53:57Z",
"published": "2022-05-13T01:53:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9862"
},
{
"type": "WEB",
"url": "https://github.com/hyperhq/hyperstart/pull/348"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103738"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Output Encoding
Use context-aware encoding. That is, understand which encoding is being used by the downstream component, and ensure that this encoding is used. If an encoding can be specified, do so, instead of assuming that the default encoding is the same as the default being assumed by the downstream component.
Mitigation
Strategy: Output Encoding
Where possible, use communications protocols or data formats that provide strict boundaries between control and data. If this is not feasible, ensure that the protocols or formats allow the communicating components to explicitly state which encoding/decoding method is being used. Some template frameworks provide built-in support.
Mitigation MIT-4.3
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
- Note that some template mechanisms provide built-in support for the appropriate encoding.
CAPEC-468: Generic Cross-Browser Cross-Domain Theft
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser.