<img class="jss552" src="https://marketing-images-qc-***-prep.prep.t****.com/api/images/1ea9163b-dd9b-4a16-b37e-fbf54e4232ba" alt="BLAH1-FRONT_QUARTER_RIGHT">  <--- my data is BLAH1 .-FRONT_QUARTER_RIGHT is appended to the end


i added "><script>alert(1)</script></  from a direct burp API call, bypassing client side controls

which resulted in:

<img class="jss199" src="https://marketing-images-qc-***-prep.prep.t*****.com/api/images/a42dcd60-9d11-435e-a60f-d7f0e3482ef7" alt="&quot;><SCRIPT>ALERT(1)</SCRIPT></-FRONT_QUARTER_RIGHT">

note: i have starred out the URL