What's in a tag name? Java Script, apparently
Summary: PortSwigger researcher Gareth Heyes found that a tag's localName property returns a lowercase version of the tag name, letting JavaScript be written into tag names and executed, and that the technique works in every browser. He fuzzed tag name transformations and found alphabetic characters, forward slashes, whitespace, and newlines get transformed while line and paragraph separator characters do not, and he built further vectors using the part attribute, classList, contenteditable, getAttributeNode, and setHTMLUnsafe, with variants also produced by Sol 5.6.
What you should know: Heyes describes the technique as a way to bypass a WAF, and notes that properties like localName, part, and classList can hide payloads that evade blocklists and WAF signatures.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026