---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce KittyScript validation for guest sessions

# Enforce KittyScript validation for guest sessions {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The com.glide.script.kittyscript.validation.mode property controls JavaScript validation for unauthenticated (guest) users before it runs in the server-side sandbox.
* `block` or `block_guest`: Rejects scripts that use syntax or operations outside a minimal, restricted set.
* `warn` or `ignore`: Reduces or removes enforcement, allowing guest scripts to run under the platform's legacy sandbox restrictions only.

Set the com.glide.script.kittyscript.validation.mode property to `block` or `block_guest` in the `sys_properties` table. If it doesn't exist, create it and set it to
`block`.

## More information {#sc-kittyscript-validation__section_wc1_cqn_phc}

{#sc-kittyscript-validation__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.script.kittyscript.validation.mode |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | block |
| Default value | block |
| Fallback value | block_guest |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 9.1 * CVSS rating: Critical * Security risk details: Allowing unauthenticated users to execute server-side JavaScript is a critical security risk. This code runs with server-side privileges and bypasses ordinary access controls. No valid credentials or user interaction is required to trigger it. An attacker who reaches this capability can use it to read, modify, or exfiltrate data, and to bypass the business logic and access restrictions that would otherwise apply. {#sc-kittyscript-validation__ul_g1g_3sf_xwb} |
| Functional impact | This property controls how the server-side sandbox validates JavaScript in guest sessions. * `ignore`: Disables validation. Guest scripts execute without sandbox restrictions. * `warn`: Allows guest script execution. Scripts that violate sandbox restrictions are logged. * `block_guest` or `block`: Enforces sandbox restrictions. Scripts using unsupported syntax or disallowed operations are blocked. {#sc-kittyscript-validation__ul_dmr_mfb_bkc} After enabling enforcement, test guest-facing functionality that uses dynamic script evaluation such as reference qualifiers and scripted default values to confirm it still works. |
| Dependencies and prerequisites | The com.glide.script.sandbox.ks.watchdog.enabled property must be set to `true`. |
[ ]

{#sc-kittyscript-validation__table_ajc_b43_3kb}