Lab: Stored DOM XSS
Summary: A PortSwigger lab demonstrates a stored DOM cross-site scripting flaw in blog comment functionality, where the site uses JavaScript's replace() function to encode angle brackets. Because replace() with a string first argument only replaces the first occurrence, adding an extra set of angle brackets at the start of a comment leaves later angle brackets unencoded, allowing HTML injection and a call to alert().
What's compelling: The filter here fails on a single well-known quirk of replace() - one extra pair of angle brackets defeats it - which is the kind of gap that survives code review and ships to production.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026