I have a system with an uploading file feature and it's protected by an antivirus that scans the uploaded files. The AV detects malicious files like EICAR files, msfvenom payloads...but not a JS file with an XSS inside.

I would like to know why that is.

  • What antivirus is that? Commented Jul 6, 2020 at 9:36
  • 4
    Because they are not designed to. XSS is not malware or a virus. Antivirus isn't a "detect all the bad things" tool.
    – schroeder
    Commented Jul 6, 2020 at 9:47
  • 7
    XSS is just JavaScript that an application owner didn't intend for their system to run. Therefore, what exactly is "XSS inside a JS file"? How would you know that some JavaScript inside a JS file is actually an XSS payload? Commented Jul 6, 2020 at 9:53
  • 1
    Same reasons they don't detect Outlook takeovers. The JS only sends many e-mails via legitimate outlook systems. The user does that too. How can you tell if there's a difference ?
    – Overmind
    Commented Jul 6, 2020 at 11:05

1 Answer 1


Because XSS is not a computer virus, but an attack vector.

Wikipedia says a computer virus is:

A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a computer virus, a metaphor derived from biological viruses.

By this definition, JavaScript files (.js) could very much be computer viruses. However, Cross-site scripting (XSS) is an attack vector where injected JavaScript code is executed in environments where such input is unexpected, for instance in form fields on a website. XSS is not a specific type of JavaScript code, it is technically any JavaScript code that executes in a place where it is not intended.

Therefore, detecting XSS is not the same as detecting a virus, since an antivirus would not know whether JavaScript code is running intentionally or not. Of course, certain actions like downloading suspicious files etc could be detected.

Protection against XSS is usually done by (1) safe output encoding, where HTML/JS code is not executed but just rendered plain text. and (2) by conducting input validation, rejecting inputs that potentially contain HTML/JS code.

  • This is a good answer, but it's also worth adding: XSS payloads are loaded over the internet from the attacker's computer, not from a victim's machine. As such, the odds that a local JS file with an XSS payload in it is going to be used to attack the user are negligible, and AV is generally not in the business of trying to guess when somebody might be attempting to create malicious software.
    – CBHacking
    Commented Nov 26, 2022 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .