---
id: 5529
title: "Abusing JavaScript frameworks to bypass XSS mitigations"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/abusing-javascript-frameworks-to-bypass-xss-mitigations"
published_at: "2019-06-14T12:14:00Z"
tags: ["xss", "portswigger", "bypass", "noscript", "dom-based", "mavo", "javascript-framework"]
phying_url: "https://phying.com/item/5529"
lang: en
---

# Abusing JavaScript frameworks to bypass XSS mitigations

## Summary

Gareth Heyes abuses the Mavo JavaScript framework's $url object to build DOM-based XSS that bypasses NoScript's XSS filter, and shows risks from attacker-controlled data sources.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:14:00Z
- **Original:** https://portswigger.net/research/abusing-javascript-frameworks-to-bypass-xss-mitigations
- **Phying News:** https://phying.com/item/5529