Yes it is? XSS lets you execute javascript code remotely; that's literally a subset of RCE. Are you talking about virtual machine escapes (running native machine code)?

No, that is not remotely what practitioners mean by RCE.

"Remote Code Execution" means the attacker can Execute Code Remotely, right? I guess you could classify the virtual machine as a (virtually) separate machine from the physical one, so that it's not a RCE on the machine you actually want to attack, but it's clearly executing code on some machine that the remote attacker isn't supposed to be able to execute code on.

No. RCE is a term of art. It implies arbitrary native code execution.

> It implies arbitrary []native[] code execution.

This is simply not true in a plurality of cases (eg, it implies that applications running under qemu are incapable of having RCE vulnerabilities) and frankly sounds like a distinction that was made up to avoid admitting that script tags are RCE bugs in web browsers.

It's interesting how much this little subthread recapitulates the experience of responding to the median bug bounty submission.

Well, modulo "responding to a submission" versus "reporting a vulnerabity", we can certainly agree on that at least.