Lab: Client-side prototype pollution in third-party libraries
Summary: PortSwigger's lab demonstrates DOM XSS via client-side prototype pollution caused by a gadget in a third-party library, which the lab notes is easy to miss because the source code is minified. Using DOM Invader, the walkthrough identifies two prototype pollution vectors in the URL hash property and reaches the setTimeout() sink through the hitCallback gadget, then delivers a payload that calls alert(document.cookie) in the victim's browser.
Why it matters: The vulnerable code sits in a third-party library's minified source, so the gadget that turns prototype pollution into DOM XSS is easy to overlook in dependency review - and the payoff is script execution in the victim's browser that reads their cookies.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026