Executing non-alphanumeric Java Script without parenthesis

Summary: PortSwigger researcher Gareth Heyes demonstrated a technique for executing non-alphanumeric JavaScript without parentheses, using template literals and the array find function to build strings like "find" and "constructor" from primitives such as +[] and [][[]]. The method reaches the Function constructor via []['constructor']['constructor'] and calls it through a template literal, since template literals invoke a function even when it is an expression.
Why it matters: The same non-alphanumeric techniques were previously used to hack Uber, and this variant removes parentheses from the attacker's toolkit - a detail that matters to anyone whose input filters or WAF rules are written to catch recognizable function-call syntax.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026