/hunt-xss

name: hunt-xss
description: Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta verified against NVD — DOMPurify nesting mXSS (CVE-2024-47875, GHSA-gx9m-whjm-85jf), DOMPurify depth-bypass family (CVE-2024-45801, GHSA-mmhx-hmjr-r674), DOMPurify mXSS via Re-Contextualization (GHSA-h8r8-wccr-v5f2), Auth0 nextjs-auth0 returnTo (CVE-2025-67716, GHSA-mr6f-h57v-rpj5), React Server Components DoS family (CVE-2025-67779/55184, GHSA-5j59-xgg2-r9c4), markdown-to-jsx iframe XSS (CVE-2024-21535), listmonk stored XSS → Admin ATO (GHSA-jmr4-p576-v565, CVSS 8.0). Use when hunting DOM XSS, stored XSS, reflected XSS, postMessage XSS, mXSS, sanitizer bypass (DOMPurify / sanitize-html / bleach), OAuth redirect_uri XSS, prototype pollution → XSS gadgets, markdown renderer XSS, Server Components content injection, agentic LLM output injection.
sources: hackerone_public, github_advisories, github_deep, intigriti, huntr, bugcrowd, project_zero, microsoft_msrc, securitylab_github, nvd_verified, cure53_advisories, portswigger_research
report_count: 1500
generated_at: 2026-05-04

Crown Jewel Targets

XSS is the highest-frequency web bug class but the modern paying surface has shifted. Reflected XSS on a public marketing page is mid four-figure at best; stored XSS chained to admin ATO is mid five-figure; mXSS bypass of a popular sanitizer pays direct from Cure53/Snyk plus downstream chains. The 24-month meta has crystallized around six asset types. All CVEs below are NVD-verified.

**1. DOMPurify mXSS bypass family (high four-figure to mid five-figure direct + thousands of downstream chains).** Every DOMPurify bypass disclosed since 2024 has cascaded through every consumer that hadn't pinned to the latest version. **CVE-2024-47875 (GHSA-gx9m-whjm-85jf, Oct 2024, GitHub CVSS 10.0)** — nesting-based mXSS by @IcesFont via cure53berlin disclosure. Versions <2.5.0 and <3.1.3 vulnerable. **CVE-2024-45801 (GHSA-mmhx-hmjr-r674)** — companion depth-bypass weakened by prototype pollution; backport reference. **GHSA-h8r8-wccr-v5f2 — DOMPurify mXSS via Re-Contextualization in 3.3.1** (Oscar Uribe / Camilo Vera / Cristian Vargas, Fluid Attacks Research) — sanitized output reinserted via `innerHTML` into a wrapper (`script`, `xmp`, `iframe`, `noembed`, `noframes`, `noscript`) mutates during second parse. **Yaniv Nizry @YNizry Dec 2024** — DOMPurify 3.2.1 non-default-config bypass via `is` attribute mishandling. **@kinugawamasato deep-nesting variant** — works on Firefox + Chromium + Safari (most other mXSS techniques only work on one browser). **@hash_kitten HTML insertion modes bypass** — full bypass without nesting. **@ryotkak XML-based bypass**. The mizu.re writeup at https://mizu.re/post/exploring-the-dompurify-library-bypasses-and-fixes is the canonical recent reference. Hunt every DOMPurify consumer that hasn't pinned to current; pays per-target.

**2. Modern JS / RSC / Server Actions content rendering (low to mid five-figure).** Next.js Server Components and Server Functions deserialize and render client-supplied content. The DoS family (CVE-2025-67779, CVE-2025-55184, GHSA-5j59-xgg2-r9c4 published Dec 11, 2025) demonstrates that the RSC runtime trusts payload structure; the same trust surface produces XSS when RSC payloads or Server Action responses round-trip through `dangerouslySetInnerHTML` or React's HTML escape boundary. Affects React 19.0.0/19.1.0/19.1.1/19.2.0 with `react-server-dom-webpack` / `parcel` / `turbopack`; patches in React 19.0.2/19.1.3/19.2.2 and Next.js 14.2.35 / 15.x point releases / 16.0.10. The Vercel Platform Protection WAF program pays for new bypass primitives.

**3. OAuth `redirect_uri` / `returnTo` XSS (low five-figure on enterprise SaaS).** **CVE-2025-67716 (GHSA-mr6f-h57v-rpj5, Dec 10 2025)** — Auth0 Next.js SDK <4.13.0 — `returnTo` parameter input-validation flaw lets attackers inject unintended OAuth query parameters into the authorization request. Disclosed by Joshua Rogers / @MegaManSec via Okta. The pattern: any OAuth library that takes `redirect_uri` / `returnTo` / `state` / `RelayState` (SAML) and reflects it back into HTML (error page, success page, logout page) without proper escaping. The HackerOne TopOAuth list (reddelexc/hackerone-reports/blob/master/tops_by_bug_type/TOPOAUTH.md) has dozens of disclosed cases — Reflected XSS at oauth2/fallbacks/error against Zomato/ORY Hydra, XSS at OAuth authorize/authenticate against X/xAI, XSS in OAuth Redirect Url at Dropbox, Stored XSS in OAuth redirect URI at Nextcloud, OAuth redirect_uri bypass via IDN homograph at Semrush (bounty $0 as the program disclosed it informational — but the technique generalizes; HackerOne disclosed write-up).

**4. postMessage XSS with origin-check bypass (mid four-figure to low five-figure on banking / fintech / chat-widget integrations).** Almost every postMessage implementation has at least one of these problems: no origin check, broken origin check (`includes()` instead of `===`), trusts message data without sanitization. **CleverTap Web SDK <=1.15.2 issue #424 (Mr-Neutr0n, Jun 2025)** — `event.origin` checked with `.includes()` allowing bypass via `dashboard.clevertap.com.attacker.com`; `display.details[0].html` field assigned to `element.innerHTML` without filtering. Bug Bounty Playbook documents this as the dominant chat-widget integration pattern: vendor's domain has its own XSS, attacker uses it to send crafted messages that pass the bank's origin check, executing in banking session context. Hunt every `addEventListener('message', ...)` in every JS bundle.

**5. Stored XSS → Admin Account Takeover via shared-content features (mid four-figure to mid five-figure).** **GHSA-jmr4-p576-v565 (listmonk, Jan 2 2026, CVSS 8.0)** — campaign-management user injects XSS payload into newsletter draft, su