DOM-based client-side XPath injection
Summary: DOM-based XPath injection occurs when a script incorporates attacker-controllable data into an XPath query, letting an attacker construct a URL that triggers an arbitrary XPath query when another user visits it. The retrieved data may differ from what the site intended, and depending on how the query results are used, the attacker may subvert the site's logic or cause unintended actions on the user's behalf.
What you should know: The attack rides in on a URL one user sends another, so the malicious query executes in the victim's browser session rather than at the server your perimeter controls watch. PortSwigger's guidance is to keep data from any untrusted source out of XPath queries entirely.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026