Javascript — PoC Archivehttps://poc.intelseclab.com/tags/javascript/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000safe-expr-eval: Mitigation Library for the expr-eval Unsafe eval() RCE (CVE-2025-12735)https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-12735-safe-expr-eval-mitigation/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-12735-safe-expr-eval-mitigation/Critical severity (CVSS 9.8) — misc · CVE-2025-12735. Status: Patched. Affects: expr-eval npm package (mathematical/logical expression evaluator). Tags: expr-eval, eval-injection, arbitrary-code-execution, rce, cwe-95, javascript, typescript, npm, expression-parser, mitigation-library, drop-in-replacement.miscCriticalexpr-evaleval-injectionarbitrary-code-executionrcecwe-95javascripttypescriptnpmexpression-parsermitigation-librarydrop-in-replacementWebKit Navigation API Cross-Port canIntercept Bypass (CVE-2026-20643)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20643-webkit-navigation-api-cross-port/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20643-webkit-navigation-api-cross-port/Medium severity — web · CVE-2026-20643. Status: PoC. Affects: WebKit (Safari / WebKit-based browsers), Navigation API implementation. Tags: webkit, browser, navigation-api, same-origin-policy, cross-port, javascript, test-page, canintercept.webMediumwebkitbrowsernavigation-apisame-origin-policycross-portjavascripttest-pagecaninterceptTanStack Query — Unbounded Recursion Denial of Service in `replaceEqualDeep` (CVE-2026-26903)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Medium severity — web · CVE-2026-26903. Status: PoC. Affects: TanStack Query (@tanstack/query-core and framework bindings: react-query, vue-query, solid-query, svelte-query). Tags: tanstack-query, javascript, denial-of-service, stack-overflow, recursion, react, frontend, client-side-dos.webMediumtanstack-queryjavascriptdenial-of-servicestack-overflowrecursionreactfrontendclient-side-dosSaleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23499-saleor-file-upload-xss/High severity — web · CVE-2026-23499. Status: PoC. Affects: Saleor (saleor/saleor). Tags: saleor, stored-xss, unrestricted-file-upload, svg-xss, session-hijack, graphql, javascript.webHighsaleorstored-xssunrestricted-file-uploadsvg-xsssession-hijackgraphqljavascriptRealtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27579-cors-misconfig-data-exposure/High severity (CVSS 7.4) — web · CVE-2026-27579 (GHSA-qh5m-p8jh-hx88). Status: PoC. Affects: realtime-collaboration-platform (karnop), backed by Appwrite. Tags: cors, misconfiguration, appwrite, cross-origin, credentials, data-exposure, session-hijack, javascript.webHighcorsmisconfigurationappwritecross-origincredentialsdata-exposuresession-hijackjavascriptoRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pageNode.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Critical severity — web · CVE-2026-41242. Status: PoC. Affects: Node.js application using protobufjs (Root.fromJSON + dynamic decode). Tags: nodejs, protobufjs, rce, deserialization, express, code-injection, javascript.webCriticalnodejsprotobufjsrcedeserializationexpresscode-injectionjavascriptMath.js Expression Parser Sandbox Bypass RCE (CVE-2026-40897)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Critical severity — web · CVE-2026-40897. Status: Weaponized. Affects: Math.js expression parser (Node.js library). Tags: mathjs, nodejs, sandbox-bypass, rce, expression-parser, prototype-pollution-adjacent, reverse-shell, javascript.webCriticalmathjsnodejssandbox-bypassrceexpression-parserprototype-pollution-adjacentreverse-shelljavascriptNext.js unstable_cache Object-Argument Cache-Key Collisionhttps://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Next.js (App Router, Data Cache). Tags: nextjs, unstable_cache, cache-poisoning, cache-key-collision, data-cache, information-disclosure, server-side-caching, javascript.webHighnextjsunstable_cachecache-poisoningcache-key-collisiondata-cacheinformation-disclosureserver-side-cachingjavascriptGoogle Chromium V8 Out-of-Bounds Read/Write — Crash PoC (CVE-2026-11645)https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/High severity (CVSS 8.8) — web · CVE-2026-11645. Status: Incomplete PoC (crash only — no confirmed public RCE chain). Affects: Google Chrome / Chromium — V8 JavaScript and WebAssembly engine. Tags: browser, chrome, v8, javascript, turbofan, out-of-bounds, memory-corruption, zero-day, incomplete-poc, active-exploitation.webHighbrowserchromev8javascriptturbofanout-of-boundsmemory-corruptionzero-dayincomplete-pocactive-exploitationConfluence Post-Auth RCE - CVE-2024-21683https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-postauth-rce-cve-2024-21683/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_confluence-postauth-rce-cve-2024-21683/High severity (CVSS 8.3) — web · CVE-2024-21683. Status: Weaponized. Affects: Atlassian Confluence Data Center and Server. Tags: RCE, Confluence, post-auth, Rhino, JavaScript, Java, deserialization, Metasploit, red-team.webHighRCEConfluencepost-authRhinoJavaScriptJavadeserializationMetasploitred-team