Burp gets new Java Script analysis capabilities

Summary: PortSwigger's latest Burp release adds a home-grown JavaScript parser and dataflow analysis engine to Burp Scanner, which traces data from potentially tainted DOM sources through execution paths to dangerous sinks and reports a potential vulnerability when it reaches one. The capability ships as officially experimental, with PortSwigger saying it will be enhanced in future releases based on user feedback.
Bottom line: The engine is built to avoid the tradeoffs PortSwigger names in the alternatives - pattern matching that only finds the simplest bugs, and instrumented-browser execution that misses execution branches and hurts performance - so the question for a security leader is whether client-side JavaScript flaws that fell between those approaches are currently being found by anyone in their stack.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026