Lab: DOM XSS via client-side prototype pollution
Summary: PortSwigger's lab demonstrates DOM XSS through client-side prototype pollution, where a query-string source lets an attacker add arbitrary properties to the global Object.prototype. The lab's searchLogger.js uses a config object's transport_url property to dynamically append a script to the DOM, and since no transport_url is defined, injecting one controls the script's src and calls alert(1).
Key Takeaway: The gadget here is a single undefined property on a config object - a pattern that appears throughout JavaScript codebases and is invisible to server-side scanning, so a client-side sink like script.src can be reached without any obvious injection point.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026