---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable sanitization of inbound virtual agent chat messages

# Enable sanitization of inbound virtual agent chat messages {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.cs.sanitize_inbound_messages.enabled property controls whether Virtual Agent runs a dedicated HTML sanitization check on inbound chat messages sent from a requester to an agent.
When set to <kbd class="ph userinput">true</kbd> (recommended), the platform strips unsafe HTML content from each inbound message. If content is removed, both the requester and the agent (in live-agent conversations) are notified that
sanitization occurred. When set to <kbd class="ph userinput">false</kbd>, inbound messages instead pass through only the legacy system-message sanitization path, and the dedicated inbound-content check is skipped.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Set the glide.cs.sanitize_inbound_messages.enabled property to <kbd class="ph userinput">true</kbd>.

## More information {#sc-enable-sanitization-of-inbound-virtual-agent-chat-messages__section_ot2_f2w_dkc}

{#sc-enable-sanitization-of-inbound-virtual-agent-chat-messages__table_8ui_j23_3ik__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.cs.sanitize_inbound_messages.enabled |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 3.5 * CVSS rating: Low * Security risk details: If this property is not set to <kbd class="ph userinput">true</kbd>, Virtual Agent chat messages from requesters skip this dedicated sanitization check. The message is delivered to the agent unfiltered. A requester can inject malicious HTML or script content into their message. When the agent views the message, the browser renders this content in the agent's session, creating a reflected cross-site scripting (XSS) attack against the agent. {#sc-enable-sanitization-of-inbound-virtual-agent-chat-messages__ul_g1g_3sf_xwb} |
| Functional impact | Enabling this property adds an additional sanitization pass to every inbound Virtual Agent chat message. Messages containing certain markup are flagged, stripped, and replaced with a system warning to the requester and agent. Live-agent handoffs receive the same treatment rather than delivery as originally typed. Availability impact is minimal because the control affects message content and rendering only---not conversation flow or session continuity. **Test these scenarios:** * \>Inbound consumer and live-agent chat conversations * Messages containing HTML-like syntax or rich-control content (for example, topic-picker selections) Verify that legitimate messages are delivered without false warnings. |
| Dependencies and prerequisites | No effect unless com.glide.cs.html.sanitizer.enabled is set to <kbd class="ph userinput">true</kbd>. |
[ ]

{#sc-enable-sanitization-of-inbound-virtual-agent-chat-messages__table_8ui_j23_3ik}