Lab: Client-side prototype pollution via flawed sanitization
Summary: PortSwigger's lab demonstrates DOM XSS via client-side prototype pollution: the site's deparamSanitized.js uses a sanitizeKey() blocklist from searchLoggerFiltered.js to strip dangerous property keys, but the filter is not applied recursively, so a blocked key can be injected in a way that survives sanitization and adds a foo property to Object.prototype. A gadget in searchLogger.js appends a script to the DOM using the config object's transport_url property when present, and polluting that property with a data: URL causes alert(1) to execute.
What you should know: The developers did implement a blocklist against prototype pollution, and it failed because it only checked the top level - a reminder that a sanitizer which does not recurse leaves the global Object.prototype reachable, and a single unset config property like transport_url is enough to turn that reachability into script execution.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026