Lab: Reflected XSS protected by CSP, with CSP bypass
Summary: This PortSwigger lab presents a reflected XSS vulnerability on a page protected by Content Security Policy, and the goal is to perform a cross-site scripting attack that bypasses the CSP and calls the alert function. The intended solution works only in Chrome and relies on the script-src-elem directive, which targets script elements and can be used to overwrite existing script-src rules so that unsafe-inline is injected and inline scripts run.
What you should know: The bypass turns on a single CSP directive, script-src-elem, that can override the script-src rules an organization believes are protecting the page - a reminder that a policy is only as strong as its least-considered directive.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026