Security

What is Improper Neutralization of Script (CWE-82)?

PenScan's guide to CWE-82, Improper Neutralization of Script in Attributes of IMG Tags in a Web Page. Learn how it works, examples, and prevention...

Shreya Pillai July 27, 2026 5 min read Security

AI-friendly summary

What it is: CWE-82 is a web application vulnerability that occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Why it matters: CWE-82 can lead to read application data and execute unauthorized code or commands. If left unaddressed, CWE-82 can result in significant business impacts, including financial losses, compliance issues, and reputational damage.

How to fix it: The primary mitigation for CWE-82 is output encoding, which involves specifying an output encoding that can be handled by the downstream component. This can be achieved through various techniques, such as using a Content Security Policy (CSP) or validating user input.

TL;DR: CWE-82 is a web application vulnerability that occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags. It can be mitigated through output encoding and other techniques.

At-a-Glance

Field	Value
CWE ID	CWE-82
OWASP Category	A9:2021 - Security Misconfiguration
CAPEC	None
Typical Severity	High
Affected Technologies	HTML, JavaScript, CSS, Web Frameworks (e.g. ASP.NET, Django)
Detection Difficulty	Moderate
Last Updated	2026-07-27

What is Improper Neutralization of Script in Attributes of IMG Tags in a Web Page?

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) is a type of security misconfiguration vulnerability that occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute. As defined by the MITRE Corporation under CWE-82, and classified by the OWASP Foundation under A9:2021 - Security Misconfiguration…

Quick Summary

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) is a web application vulnerability that can lead to significant business impacts. It occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute. The primary mitigation for CWE-82 is output encoding, which involves specifying an output encoding that can be handled by the downstream component.

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Overview

What

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) is a web application vulnerability that occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Why it matters

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) can lead to significant business impacts, including financial losses, compliance issues, and reputational damage. If left unaddressed, CWE-82 can result in unauthorized access to sensitive data, execution of malicious code, and disruption of business operations.

Where it occurs

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) typically occurs in web applications that use HTML IMG tags with scripting elements within their attributes. This includes web applications built using popular frameworks such as ASP.NET, Django, and Ruby on Rails.

Who is affected

Any organization that uses web applications vulnerable to CWE-82 is at risk of experiencing significant business impacts. This includes organizations in various industries, including finance, healthcare, and e-commerce.

Who is NOT affected

Organizations that do not use web applications built using HTML IMG tags with scripting elements within their attributes are not affected by CWE-82. Additionally, organizations that have implemented robust security measures, such as output encoding and Content Security Policy (CSP), may be less susceptible to CWE-82.

How Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Works

Root Cause

The root cause of CWE-82 is the failure of the web application to neutralize or incorrectly neutralize scripting elements within attributes of HTML IMG tags, such as the src attribute. This allows attackers to inject malicious code into the web application.

Attack Flow

An attacker sends a request to the web application with a malicious IMG tag containing a scripting element.
The web application processes the request and fails to neutralize or incorrectly neutralizes the scripting element.
The malicious code is executed, allowing the attacker to access sensitive data or execute unauthorized actions.

Prerequisites to Exploit

The web application must use HTML IMG tags with scripting elements within their attributes.
The web application must fail to neutralize or incorrectly neutralize the scripting element.
The attacker must be able to send a request to the web application with a malicious IMG tag containing a scripting element.

Vulnerable Code

<img src="javascript:alert('XSS')">

This code snippet demonstrates a vulnerable HTML IMG tag with a scripting element within its attribute. The src attribute contains a JavaScript code that alerts an XSS message.

Secure Code

<img src="image.jpg" onerror="this.src='https://example.com/image.jpg'">

This code snippet demonstrates a secure HTML IMG tag with a scripting element within its attribute. The onerror attribute specifies a fallback image source, preventing the execution of malicious code.

Business Impact of Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Confidentiality

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) can lead to unauthorized access to sensitive data, including financial information, personal identifiable information, and confidential business data.

Integrity

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) can allow attackers to modify or delete sensitive data, compromising the integrity of the web application.

Availability

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page (CWE-82) can disrupt business operations by causing the web application to become unavailable or slow down.

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Attack Scenario

An attacker sends a request to the web application with a malicious IMG tag containing a scripting element.
The web application processes the request and fails to neutralize or incorrectly neutralizes the scripting element.
The malicious code is executed, allowing the attacker to access sensitive data or execute unauthorized actions.

How to Detect Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Manual Testing

Review the web application’s HTML IMG tags and attributes for any suspicious or malicious content.
Test the web application by sending requests with malicious IMG tags containing scripting elements.

Automated Scanners (SAST / DAST)

Use automated scanners to identify potential vulnerabilities in the web application, including CWE-82.
Configure the scanners to detect and report on suspicious or malicious content within HTML IMG tags and attributes.

PenScan Detection

PenScan’s automated scanning engine actively tests for CWE-82 by analyzing the web application’s HTML IMG tags and attributes for any suspicious or malicious content. If a vulnerability is detected, PenScan will provide detailed recommendations for remediation.

False Positive Guidance

A finding on an <img> attribute value that’s already run through the template engine’s context-aware HTML-attribute encoding is a false positive — confirm the attribute is actually rendered without escaping before treating the finding as real.

How to Fix Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Implement output encoding to neutralize or correctly encode scripting elements within attributes of HTML IMG tags.
Review and update the web application’s security configuration to prevent CWE-82.
Test the web application to ensure that it is no longer vulnerable to CWE-82.

Framework-Specific Fixes for Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

ASP.NET

protected void Page_Load(object sender, EventArgs e)
{
    Response.AppendHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' https://example.com");
}

This code snippet demonstrates how to implement output encoding and Content Security Policy (CSP) in ASP.NET.

Node.js

const express = require('express');
const app = express();

app.use((req, res, next) => {
    res.append("Content-Security-Policy", "default-src 'self'; script-src 'self' https://example.com");
});

This code snippet demonstrates how to implement output encoding and Content Security Policy (CSP) in Node.js.

How to Ask AI to Check Your Code for Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Review the following [language] code block for potential CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page vulnerabilities and rewrite it using output encoding:

<img src="javascript:alert('XSS')">

Rewrite the code to use output encoding and Content Security Policy (CSP):

<img src="image.jpg" onerror="this.src='https://example.com/image.jpg'">

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Best Practices Checklist

✅ Implement output encoding to neutralize or correctly encode scripting elements within attributes of HTML IMG tags. ✅ Review and update the web application’s security configuration to prevent CWE-82. ✅ Test the web application to ensure that it is no longer vulnerable to CWE-82.

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page FAQ

How does CWE-82 occur?

CWE-82 occurs when the web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

What are the common consequences of CWE-82?

The common consequences of CWE-82 include read application data and execute unauthorized code or commands.

How can I detect CWE-82 in my web application?

You can detect CWE-82 by using manual testing, automated scanners (SAST / DAST), and PenScan detection.

What are the potential mitigations for CWE-82?

The potential mitigations for CWE-82 include output encoding and attack surface reduction.

How can I prevent CWE-82 in my web application?

You can prevent CWE-82 by implementing output encoding, using a Content Security Policy (CSP), and validating user input.

The related weaknesses to CWE-82 include CWE-83: Improper Neutralization of Script in Attributes in a Web Page.

How can I ask AI to check my code for CWE-82?

You can ask AI to check your code for CWE-82 by reviewing the following [language] code block for potential CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page vulnerabilities and rewriting it using output encoding.

CWE ID	Name	Relationship
CWE-83	Improper Neutralization of Script in Attributes in a Web Page	ChildOf

References

Scan Your Own Site

PenScan’s automated scanning engine actively tests for this issue.