Defeating XSS Filters with CSS Animation Exploits

This writeup reveals critical gaps in XSS defense strategies by demonstrating how CSS animations combined with base64 and hex encoding can bypass strict server-side filters. While tools like DOMPurify sanitize some inputs, inconsistent application across all user-controlled fields—such as unsanitized username fields—creates exploitable vulnerabilities, highlighting the fundamental limitations of blacklist-based protection and the necessity for comprehensive, layered security approaches.