# Interesting case of a DOM XSS in www.figma.com

Figma community file descriptions were assigned to innerHTML before DOMPurify sanitization, so img onerror fired during parsing, yielding DOM XSS despite CSP.

- Payout: $1,000
- Severity: medium
- Program: Figma
- Credited: Sudhanshu Rajbhar, huli
- Disclosed: 2023-10-20
- Write-up quality: 7/10
- Original: https://github.com/Sudistark/xss-writeups/blob/main/figma.com-xss.md
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-xss-writeups-blob-main-figma-com-xss-md
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:js-analysis technique:source-review vuln:xss

**Target:** www.figma.com community file publish description field
**Root cause:** User-controlled description was set as innerHTML on a detached div before DOMPurify ran; event handlers like onerror execute during parsing even when the element is not attached to the DOM.
**Steps:**
1. Publish a design to Community and intercept the submit request.
2. Replace description with `<p><strong><em>shirley<img src=x onerror=alert()></em></strong></p>`.
3. Server stores raw payload; client sets it via `div.innerHTML = e` before `DOMPurify.sanitize`.
4. The img onerror fires during parsing, executing JS before sanitization strips the tag.
**How found:** Noticed the description editor allowed bold/italic and the submit request carried raw HTML tags; direct UI input was HTML-encoded but raw request editing preserved tags, indicating client-side-only sanitization. DOMInvader located the sanitize call; huli then found the simple img onerror payload bypassed DOMPurify due to the innerHTML-before-sanitize ordering.
**Exploitation:** Attacker publishes a community file with a crafted description; when rendered, the detached-div innerHTML parse triggers onerror, executing attacker JS in figma.com origin (CSP blocked further escalation).
**Insight:** When a sanitizer runs after innerHTML assignment on a detached element, event handlers can fire during parsing before sanitization—test payloads that execute on parse (img onerror, svg onload) rather than relying on DOM insertion.