Expected Findings
- Model output is rendered with `innerHTML` rather than text nodes.
- `<script>` and `<img onerror>` payloads execute in the chat surface.
- Markdown sanitizer is disabled because it broke a rich-content demo.
Chat Renderer
LLM Output as HTML
The chat UI inserts the model's reply via `innerHTML`, so any HTML or `<script>` tag the model emits executes in the user's session.
CWE-79CWE-94
LLM reply
Primary Flows
- Reply endpoint Returns raw HTML
Signals
Renderer
el.innerHTML = response.html // model is trusted