Skip to content
Bypassing AngularJS bind HTML
portswigger.net | research | #xss | #portswigger | #cors | #angularjs | #svg | #ng-bind-html | #cross-origin
Summary
Gareth Heyes abuses the SVG use element to include cross-origin SVG on legacy Edge, achieving script execution that bypasses AngularJS ng-bind-html in versions before 1.5.0.
- Published
- Collected