Dangling markup injection
Summary: Dangling markup injection is a technique for capturing data cross-domain when a full cross-site scripting attack is not possible, used when an application embeds attacker-controllable data into responses without filtering or escaping the > or " characters. The payload creates an img tag with an unclosed src attribute pointing at the attacker's server, so the browser reads ahead to the next single quotation mark and sends everything in between to the attacker in the URL query string, URL-encoding non-alphanumeric characters.
What's compelling: The captured response segment can include CSRF tokens, email messages, or financial data, and any attribute that makes an external request can carry it out. PortSwigger notes that input filters, content security policy, or other obstacles that block XSS may still leave this path open, and CSP that blocks img from loading external resources stops only some attacks.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026