Finding DOM Polyglot XSS in PayPal the Easy Way
Summary: PortSwigger researcher Gareth Heyes used the newly developed DOM Invader tool to find a DOM XSS vulnerability on PayPal, where a canary value was reflected inside an id attribute and the injected value had to be a valid CSS selector. PayPal's HackerOne triager declined the report because it lacked a CSP bypass, so Heyes studied the policy's allow list of *.paypalobjects.com and *.paypal.com plus its 'unsafe-eval' directive, found an older Bootstrap 3.4.1 and a PayPal-hosted youtube.js file with a DOM XSS hole, and chained an iframe srcdoc injection with jQuery and the YouTube gadget to achieve a full CSP bypass.
What you should know: PayPal's allow list and 'unsafe-eval' directive meant a single insecure jQuery selector in a file called youtube.js was enough to defeat the CSP across all of PayPal, and the researchers note jQuery will convert and execute injected scripts under 'unsafe-eval' even without a separate bypass.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026