SNOW-AF-14: Agent Writes HTML or [code] Markup Into Work Notes
🔴 High · ServiceNow Action Fabric
Detects ServiceNow AI Agent tools/scripts that insert HTML or [code] journal markup into work_notes / comments from LLM or user input. Journal fields render markup for agents and fulfillers, enabling stored XSS.
Details
| Field | Value |
|---|---|
| Rule ID | SNOW-AF-14 |
| Severity | High |
| Category | ServiceNow Action Fabric |
| Platforms | servicenow |
Remediation
Strip HTML and [code]...[/code] blocks from model output before setValue/setDisplayValue on work_notes or comments, or write plain text only. Prefer GlideElement.setValue with sanitized content; never concatenate raw LLM output into journal fields.