To handle cross-site scripting (XSS) attacks in a .NET MVC application, developers can sanitize user input by encoding it before displaying it in views. The ASP.NET MVC framework provides built-in features like request validation and output encoding to prevent XSS attacks.