# User URL in script src

User-controlled URL concatenated into script src or download URL with only substring validation

_Area: Web injection and code execution. Seen in 2 disclosed reports; 2 confirmed bounties: $150 and $2,400; latest 2023-04-16. Updated 2026-10-23._

## How it works
Code takes a user-supplied URL or version string and concatenates it into a `<script src>`, loader URL, or download URL. The only guard is a substring or prefix check (`include?("gist.github.com")`, a bare hostname match). That check tests whether the string *contains* a trusted token, not whether the resolved destination *is* the trusted host. Any URL that carries the token but resolves elsewhere passes, and the browser or downloader then fetches attacker-chosen bytes and executes them in the trusted origin's context [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md)[E3](https://bugbountylibrary.com/r/h1%3A1895277.md).

## Where it shows up
- A URL variable interpolated into `<script src=...>` or an embed/loader tag [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md)
- Validation using `include?`, `contains`, `startsWith`, or unanchored regex on a URL [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md)
- Config fields (e.g. a version string) concatenated into a download URL [E3](https://bugbountylibrary.com/r/h1%3A1895277.md)
- Downloaded content that is chmod'd and executed without integrity check [E3](https://bugbountylibrary.com/r/h1%3A1895277.md)
- Endpoints serving attacker-uploaded bytes with a preserved MIME type [E1](https://bugbountylibrary.com/r/blog%3Ablog-slonser-info-posts-cve-2023-5480.md)

## How to review
Check the exact invariant: the *resolved* destination must equal an allowlisted host and scheme, not merely contain a trusted substring. Parse the URL, compare the host component against an exact allowlist, reject `//host`, `user@host`, `host.evil.com`, and redirecting paths [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md). For version/path fields, reject `..` and path separators before building the URL [E3](https://bugbountylibrary.com/r/h1%3A1895277.md). For downloaded executables, verify a pinned hash/signature before execution [E3](https://bugbountylibrary.com/r/h1%3A1895277.md). For manifest/body fetches, confirm the consumer honors `Content-Disposition: attachment` and does not parse attacker-uploaded bodies [E1](https://bugbountylibrary.com/r/blog%3Ablog-slonser-info-posts-cve-2023-5480.md).

## Variants seen
- Substring-only URL check feeding `<script src>` in a template tag [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md)
- User version field building a download URL, redirected via `../bucket/object` to attacker storage, then executed [E3](https://bugbountylibrary.com/r/h1%3A1895277.md)
- Spec change causing a browser to consume a response body it previously ignored, turning download endpoints into script sources [E1](https://bugbountylibrary.com/r/blog%3Ablog-slonser-info-posts-cve-2023-5480.md)

## Impact and severity
Stored XSS executing in every reader's browser [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md); remote command execution on a worker via a fetched-and-executed binary [E3](https://bugbountylibrary.com/r/h1%3A1895277.md); origin XSS via a JIT-installed Service Worker [E1](https://bugbountylibrary.com/r/blog%3Ablog-slonser-info-posts-cve-2023-5480.md). Severity is high because execution lands in a trusted origin or host. Worse when the fetched artifact runs with no integrity check and when the input is stored and served to many users.

## Why fixes fail
Substring checks look safe but admit `//host`, `user@host`, and `host.evil.com`; unanchored Ruby `^...$` regex is newline-bypassable — use `\A...\z` [E2](https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md). Fixes that block one shape leave the others.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-slonser-info-posts-cve-2023-5480.md
- E2: https://bugbountylibrary.com/r/blog%3Adev-to-antogarand-pwned-together-hacking-devto-hkd.md
- E3: https://bugbountylibrary.com/r/h1%3A1895277.md