Java Script injection (DOM-based)
Summary: DOM-based JavaScript injection occurs when a client-side script reads data from a controllable part of the DOM, such as the URL, and executes that data as JavaScript. An attacker can craft a URL that, when visited by another user, runs attacker-supplied code in that user's browser within their session with the application, enabling actions such as stealing session tokens or login credentials, performing arbitrary actions on the victim's behalf, and logging keystrokes.
Why it matters: The payload runs inside the victim's authenticated session, so a single crafted link can hand over session tokens or login credentials and capture keystrokes. PortSwigger also notes that static analysis alone can produce false positives that are not actually exploitable, so a scanner finding without dynamic evidence needs code and execution-path review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026