Characters allowed in between @import

Novice Fuzzer

Created bybribes

Created Oct 19, 2025

Updated Oct 19, 2025

Unable to render tweet button

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<style>⟦0D⟧
@import$[chr]'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D

Code used after fuzz:

window.getComputedStyle(x).color === 'rgb(255, 0, 0)' && log($[i])

Sample payloads

<style>⟦0D⟧
@import⟦00⟧'//91e7358bc4c4.ngrok-free.app/test.css'⟦0D⟧
</style>0x0D
<div id=x>test</div>0x0D