---
name: web-injection-and-code-execution
description: "A defensive review workflow for web injection and code-execution weaknesses (XSS, SQL/NoSQL, template, XXE, command, deserialization, upload/path traversal, prototype pollution) that guides a reviewer to map input-to-sink flows and apply the pattern index on an authorized target."
---

# Web injection and code execution

XSS, SQL and NoSQL injection, template injection, XXE, command injection, deserialization, file upload and path traversal, prototype pollution.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 64 newer reports it was not written from: following it finds about 59% of them._

## Approaching Web Injection & Code Execution

**Goal:** find where untrusted input crosses into an interpreter — HTML/JS, SQL, shell, template, XML, deserializer, filesystem — and whether the boundary is enforced at the *sink*, not just the entry.

**1. Map the data flow first.** Inventory every input (query, body, headers, cookies, uploads, filenames, archive entries, message events, stored fields) and every sink (HTML render, DOM APIs, SQL text, shell, template engine, XML parser, deserializer, file path, redirect, header). Draw the lines between them. Injection lives on those lines.

**2. Ask the boundary questions.** For each line: Is the value encoded *for the exact context* at the sink? Is it parsed (scheme, path, type) before use, or only substring-checked? Does validation run on the same string the sink consumes — after decode, normalize, truncate? Can the parser and the checker disagree on the same bytes?

**3. Prioritize by reach and trust.** Stored and cross-user flows first (stored XSS, cache poisoning, uploads). Then anything reaching an interpreter with side effects (deserialization, eval, template, JNDI, shell). Then path/redirect/header handling where a check-then-use gap is likely.

**4. Use the patterns as a checklist, not a script.** Each pattern names a *shape* of weakness — read it, then hunt that shape in the mapped flows. When you find one candidate, trace the full path end to end and confirm the sink actually executes or resolves the value. Note alternate contexts (re-render, decode, second parser) that re-open a closed hole.

**5. Record evidence.** For each finding: input, path, sink, why the control fails, and the minimal condition that proves it. Flag near-misses where a control exists but is context-mismatched.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Stored XSS from unescaped persisted fields
Stored value rendered as raw HTML at any sink; check every decode, re-render, alternate context and MIME type

_68 reports · 43 confirmed bounties, median $1,250, up to $13,950._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/stored-xss-unescaped-field.md

### javascript: URI scheme validation bypass
URLs reaching href, src, iframe or OS handlers without a parsed-scheme allowlist at the sink

_30 reports · 18 confirmed bounties, median $1,700, up to $12,500._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/javascript-uri-scheme-bypass.md

### Reflected XSS via unescaped request data
Request values echoed into HTML, scripts, SVG, or URLs without context encoding

_29 reports · 13 confirmed bounties, median $1,000, up to $15,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/reflected-xss-unescaped-param.md

### Path traversal via unsanitized path join
User input joined into a file path without decode, canonicalize, and root confinement

_28 reports · 15 confirmed bounties, median $5,000, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/path-traversal-unsanitized-path-concat.md

### postMessage origin check bypass
Message listeners trusting any origin, referrer, or query-derived origin feeding DOM, URL, or eval sinks

_21 reports · 12 confirmed bounties, median $500, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/postmessage-missing-origin-check.md

### Sanitizer parser differential bypass
Sanitizer and browser parse the same bytes differently, so approved markup becomes live script

_21 reports · 13 confirmed bounties, median $2,400, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/sanitizer-parser-differential.md

### Shell string command injection
User-influenced value pasted into a shell command string instead of an argument array

_20 reports · 8 confirmed bounties, median $3,500, up to $33,510._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/command-injection-interpolated-shell.md

### XSS attribute context breakout
User value in an HTML attribute where the delimiting quote is unescaped or re-parsed downstream

_20 reports · 11 confirmed bounties, median $2,000, up to $16,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/xss-attribute-context-breakout.md

### DOM XSS via HTML parsing sinks
Untrusted data reaching innerHTML, jQuery html/append, style blocks, or selectors without prior encoding

_19 reports · 11 confirmed bounties, median $1,000, up to $8,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/dom-xss-innerhtml-sink.md

### SQL injection via concatenated queries
User values joined into SQL text instead of bound; check ORDER BY sinks, SECURITY DEFINER helpers, legacy endpoints

_17 reports · 8 confirmed bounties, median $3,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/sql-injection-concatenated-query.md

### Unsafe deserialization of untrusted input
Attacker bytes reaching unserialize, YAML.load, BinaryFormatter, phar://, AMF or session sinks

_15 reports · 9 confirmed bounties, median $1,250, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/unsafe-deserialization-untrusted-input.md

### Path traversal check bypass via encoding
Check and file open see different strings: decode, normalize, strip or truncate happens after validation

_14 reports · 5 confirmed bounties, median $1,500, up to $17,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/path-traversal-filter-bypass.md

### CRLF injection into protocol headers
User input concatenated into headers or line-based protocol commands without stripping CR, LF, or quotes

_14 reports · 12 confirmed bounties, median $1,340, up to $35,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/crlf-header-injection.md

### Prototype pollution via recursive merge
Untrusted keys reaching merge/deep-set helpers, then a sink reading the polluted property name

_12 reports · 6 confirmed bounties, median $3,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/prototype-pollution-merge-sink.md

### XXE via external entity resolution
Untrusted XML/SVG/SAML parsed with entities, DTDs or XInclude enabled, reaching files, SSRF or metadata

_10 reports · 4 confirmed bounties, median $1,750, up to $9,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/xxe-external-entities-enabled.md

### Archive extraction path traversal
Archive entry names or symlinks reaching file writes without canonical-path containment

_8 reports · 3 confirmed bounties, median $15,000, up to $29,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/path-traversal-archive-extraction.md

### Git argument injection via user refs
User ref, path or URL reaching a git subcommand as a positional arg without a -- separator

_8 reports · 6 confirmed bounties, median $6,500, up to $12,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/argument-injection-git-flags.md

### Eval sink code injection
Attacker-influenced strings reaching eval, new Function, const_get, require, autoload, or script engines as code

_8 reports · 6 confirmed bounties, median $10,000, up to $50,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/code-injection-eval-sink.md

### Symlink following in file operations
Writes, deletes, or extraction that follow symlinks out of the intended directory

_7 reports · 4 confirmed bounties, median $2,256, up to $11,250._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/path-traversal-symlink-following.md

### Sanitizer allowlist misses foreign content
Allowlisted SVG, MathML, style, select or xmp containers where nested or referenced markup escapes the sanitizer's parse

_7 reports · 5 confirmed bounties, median $2,400, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/sanitizer-allowlist-foreign-content.md

### Executable file upload to web-served path
Uploads stored where the server executes them; validator and executor disagree on extension or archive member

_7 reports · 3 confirmed bounties, median $3,100, up to $5,600._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/unrestricted-file-upload-executable.md

### Unescaped HTML injection in renderers
User or page text parsed as HTML in templates, WebViews, or raw-render flags, enabling markup and resource loads

_7 reports · one confirmed bounty: $1,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/html-injection-markup-resource-fetch.md

### Server-side template injection
User input parsed as template source or evaluated expression instead of passed as data

_6 reports · 5 confirmed bounties, median $8,000, up to $23,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/ssti-user-input-template.md

### Redirect scheme not allowlisted
Redirect params reaching Location, href or navigation sinks without a post-parse scheme allowlist

_6 reports · 4 confirmed bounties, median $810, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/open-redirect-javascript-scheme.md

### Deserialization type instantiation gadget chains
Input picks a class or type name that gets instantiated, reaching constructors, getters, or loaders with side effects

_5 reports · 2 confirmed bounties: $500 and $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/deserialization-type-instantiation-gadget.md

### Parser differential across trust boundaries
Same bytes parsed twice with different rules; check line breaks, duplicate keys, magic-byte offsets

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/parser-differential-across-trust-boundaries.md

### Inline-served uploads execute as active content
Uploads served inline with attacker-controlled type, sniffable or scriptable (SVG/HTML) on the app origin

_5 reports · 3 confirmed bounties, median $1,000, up to $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/uploaded-file-served-inline-active.md

### CSS injection data exfiltration
User-controlled CSS reading attribute values and leaking them via selector-triggered external requests

_4 reports · one confirmed bounty: $500._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/css-injection-exfiltration.md

### ReDoS catastrophic backtracking
Regex with nested or overlapping quantifiers run on attacker-controlled input; benchmark worst-case, not typical, strings

_4 reports · 4 confirmed bounties, median $1,381, up to $2,162._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/redos-catastrophic-backtracking.md

### CSP bypass via allowlisted script hosts
Allowlisted origins that serve user-influenced JS, JSONP callbacks, embed providers, or readable nonces

_4 reports · 2 confirmed bounties: $750 and $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/csp-bypass-via-allowlisted-script-hosts.md

### CSV formula injection in exports
User-controlled fields written to CSV exports that begin with =, +, -, @, or break quoting

_3 reports · 2 confirmed bounties: $500 and $1,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/csv-formula-injection.md

### JNDI lookup injection via attacker strings
User-controlled strings reaching JNDI lookups, JAAS configs, or loggers that resolve ${jndi:} expressions

_3 reports · one confirmed bounty: $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/jndi-lookup-injection.md

### Unauthenticated SQL injection via raw concatenation
Request params or headers reaching raw SQL before auth; legacy SOAP/ISAPI endpoints; quote-triggered DB errors

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/unauthenticated-param-to-sql.md

### Filename interpolated into shell command
User-controlled filenames reaching shell exec, popen, or interpreter command strings without escaping

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/filename-interpolated-into-shell.md

### Unescaped attribute markup injection
User values placed in title, tooltip, or image attributes and parsed as HTML

_3 reports · one confirmed bounty: $300._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/unsanitized-attribute-rendered-as-markup.md

### Sanitizer attribute allowlist bypass
Sanitizer keeps data-* or framework attributes that downstream code re-parses into HTML or handlers

_3 reports · 2 confirmed bounties: $337 and $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/sanitizer-attribute-allowlist-bypass.md

### Unsandboxed Markdown in privileged renderer
Markdown/webview rendering attacker HTML with script or same-origin access to privileged APIs

_3 reports · 2 confirmed bounties: $100 and $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/markdown-preview-unsandboxed-render.md

### Image converter delegate command execution
Uploads reaching ImageMagick/Ghostscript delegates via pseudo-protocols or renamed PostScript, not real images

_3 reports · one confirmed bounty: $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/image-converter-delegate-execution.md

### Pre-auth endpoint to dangerous sink
Unauthenticated handler passing request data into deserializer, JDBC URI, or command without allowlist

_3 reports · one confirmed bounty: $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/unauthenticated-endpoint-reaches-dangerous-sink.md

### Cache poisoning via unkeyed input
Unkeyed headers, params or path forms that the cache and origin interpret differently, then get stored.

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/cache-poisoning-unkeyed-input.md

### User URL in script src
User-controlled URL concatenated into script src or download URL with only substring validation

_2 reports · 2 confirmed bounties: $150 and $2,400._
Full pattern: https://bugbountylibrary.com/skills/web-injection-and-code-execution/user-url-into-script-src.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Newline injection into protocol commands**: User field with unsanitized CRLF concatenated into SMTP or protocol command lines (https://bugbountylibrary.com/r/h1%3A1509216.md)
- **Auth bypass chained into injection sink**: Forged or skipped auth headers letting untrusted POST data reach deserialization, SQL, or command sinks (https://bugbountylibrary.com/r/blog%3Awiz-io-blog-inside-the-metabase-sqli-exploited-in-the-wild.md)
- **CRLF injection into protocol commands**: User-controlled fields (email, config, headers) written into SMTP or protocol streams without newline stripping (https://bugbountylibrary.com/r/h1%3A1516377.md)
- **Failed auth check falls through to sink**: Auth failure branch lacks return/exit before deserialization or dangerous operation (https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- **Header injection via blocklist filtering**: Client-supplied header fields filtered by deny-list rather than allow-list before forwarding (https://bugbountylibrary.com/r/h1%3A3789570.md)
- **Link href set without scheme validation**: User-supplied URLs assigned to href or iframe src without javascript/data scheme checks (https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-clipboard-microsoft-whiteboard-excalidraw-meta.md)
- **Reflected XSS with permissive CSP**: Unescaped reflected params plus CSP allowing inline or broad script sources (https://bugbountylibrary.com/r/blog%3Abergee-it-blog-the-story-of-exposed-service-ssrf-csp-bypass-and-credentials-stealing-via-xss.md)
- **Regex capture concatenated into query**: Unanchored regex extracts user text then concatenates it into SQL without parameterization (https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-10-600000-wordpress-sites-affected-by-sql-injection-vulnerability-in-backuply-wordpress-plugin.md)
- **Signature length extension enables injection**: MAC built as hash(secret||data) with weak hash, appended payload accepted (https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md)
- **Terminal escape sequence injection**: Unsanitized user fields printed to terminal without stripping ANSI/control sequences (https://bugbountylibrary.com/r/blog%3Amaxwelldulin-com-blogpost-stdout-cosmos-sdk-rce.md)
- **Unsafe YAML load of user input**: User-controlled parameter passed to YAML load/parse without safe loader (https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-pre-auth-rce-in-aspera-faspex-case-guide-for-auditing-ruby-on-rails.md)
- **Unvalidated URL passed to OS handler**: Server or client URL passed to shell open, intent, or OS handler without scheme allowlist (https://bugbountylibrary.com/r/h1%3A1078002.md)
- **Unvalidated identifier used in file path**: Embed or resource IDs joined into filesystem paths without traversal checks (https://bugbountylibrary.com/r/blog%3Alyra-horse-blog-2024-09-using-youtube-to-steal-your-files.md)
- **User message tokenized into native command**: Incoming message text split and routed to native command execution (https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injec.md)
- **WebView javascript URL top navigation**: WebView rendering untrusted content with javascript: URLs reaching the top document or exported loaders (https://bugbountylibrary.com/r/h1%3A906433.md)
- **postMessage listener without origin loads native**: Message handler lacks origin check and passes data to native library or path load (https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-universal-code-execution-browser-extensions.md)
- **postMessage listener without origin validation**: Message event handler reads data and acts without checking event.origin (https://bugbountylibrary.com/r/h1%3A231053.md)