---
id: 5535
title: "Bypassing CSP using polyglot JPEGs"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs"
published_at: "2019-06-14T12:15:00Z"
tags: ["burp-suite", "web-security", "xss", "javascript", "csp-bypass", "polyglot-jpeg"]
phying_url: "https://phying.com/item/5535"
lang: en
---

# Bypassing CSP using polyglot JPEGs

## Summary

Gareth Heyes shows how to build a polyglot JavaScript/JPEG that remains a valid image yet executes as script, bypassing CSP on sites that host user-uploaded images on the same domain.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2019-06-14T12:15:00Z
- **Original:** https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs
- **Phying News:** https://phying.com/item/5535