Client-side JSON injection (DOM-based)
Summary: DOM-based JSON injection occurs when a client-side script reads data from a controllable part of the DOM, such as the URL, and incorporates it into a string that is parsed as JSON and then processed by the application. An attacker can construct a URL that, when visited by another user, causes arbitrary JSON data to be processed, potentially subverting application logic or causing unintended actions on that user's behalf.
What you should know: PortSwigger notes that static analysis alone can flag this issue as a false positive, so without dynamic evidence from Burp Scanner the code and execution paths must be reviewed by hand to confirm whether the vulnerability is real or mitigated.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026