DOM-based client-side JSON injection
Summary: PortSwigger describes DOM-based JSON injection as occurring when a script places attacker-controllable data into a string that is then parsed as JSON and processed by the application. An attacker can build a URL that, when another user visits it, causes arbitrary JSON data to be processed, potentially subverting the site's logic or triggering unintended actions on that user's behalf.
What's compelling: The payload travels in a URL and executes in another user's session, so a crafted link can make the application act on data the site never intended to accept, without the victim doing anything beyond clicking.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026