Lab: Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped
Summary: This PortSwigger Web Security Academy lab describes a reflected cross-site scripting vulnerability in search blog functionality, where the input is reflected inside a JavaScript template string with angle brackets, single and double quotes HTML-encoded and backticks escaped. The documented solution is to submit the payload ${alert(1)}, which executes JavaScript inside the template string and triggers an alert when the page loads.
Why it matters: The lab shows that escaping backticks and encoding quotes and angle brackets does not close off a template literal: the ${...} interpolation syntax still executes code, so a filter tuned to those characters alone leaves the injection path open.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026