Abusing Java Script frameworks to bypass XSS mitigations
Summary: PortSwigger researcher Gareth Heyes documented how the JavaScript framework Mavo, which lets developers build interactive apps in pure HTML, can be abused to bypass XSS mitigations including NoScript's XSS filter, DOMPurify, and CSP. Heyes reported a DOM-based XSS issue to the CSS working group on 31 May 2017, where Mavo's $url object was used to assign an anchor href, and he worked with NoScript creator Giorgio Maone through repeated filter bypasses using MavoScript features such as the 'and' and 'or' keywords, '=' for equality, square-bracket expressions, and the mv-if, mv-value, and mv-expressions attributes.
What's compelling: Each time Maone hardened NoScript's detection, Heyes found another bypass through Mavo's parser, and Mavo's ability to repoint an app's data source to an external JSON file with an Access-Control-Allow-Origin:* header let an attacker deface a site or inject JavaScript URLs - a class the article calls data source hijacking.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026