Galaxy-sc/CVE-2026-47423-dompurify-xss-detector
PoC files
3 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Go-based scanner that fetches a target URL, extracts JavaScript file paths, and checks their content for the presence of 'dompurify' and 'selectedcontent' strings to identify potentially vulnerable DOMPurify deployments.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Go-based scanner and a README that describe and implement a detection tool for CVE-2026-47423. The Go code performs HTTP requests to a user-supplied target, fetches JavaScript files, and checks for the presence of 'dompurify' and 'selectedcontent' strings. No backdoor, concealed operator-directed harm, credential theft, persistence, or unrelated payload is observed. The tool's behavior is limited to the stated vulnerability detection purpose.
Classification basis and observed behavior
Classification basis
The code only detects the presence of specific strings in JavaScript files to report potential vulnerability; it does not construct or deliver an XSS payload, trigger the vulnerability, or perform any exploitation. The README describes it as a 'Detection Tool' and 'scanner'.
CVE-2026-47423.go:130-134README.md:1-3Requirements
- Target URL must be provided via -u or -url flag.
CVE-2026-47423.go:41-42 - Target must serve HTML containing <script> tags with src attributes pointing to JavaScript files.
CVE-2026-47423.go:76-77
Observed behavior
- Fetches the HTML of the target URL.
CVE-2026-47423.go:64 - Extracts JavaScript file paths from <script> tags using a regular expression.
CVE-2026-47423.go:76-77 - Fetches each extracted JavaScript file.
CVE-2026-47423.go:114 - Checks if the JavaScript content contains the case-insensitive strings 'dompurify' (or 'createdompurify') and 'selectedcontent'.
CVE-2026-47423.go:130-131 - Reports 'VULNERABILITY CONFIRMED' if both strings are found, otherwise reports no vulnerable signatures matched.
CVE-2026-47423.go:101-107CVE-2026-47423.go:110
Behaviors behind the backdoor verdict
Observables
- Network Connection
- User-supplied target URLThe tool connects to a target URL provided via command-line flags -u or -url. This is expected behavior for a vulnerability scanner.
CVE-2026-47423.go:64 - Network Connection
- JavaScript file URLs extracted from target HTMLThe tool fetches JavaScript files referenced in the target page's HTML to analyze their content. This is part of the stated detection logic.
CVE-2026-47423.go:114 - String Matching
- dompurify, createdompurify, selectedcontentThe tool checks fetched JavaScript for these case-insensitive substrings to determine if a vulnerable DOMPurify version is present. This is the core detection logic.
CVE-2026-47423.go:130-131 - Tls Configuration
- InsecureSkipVerify: trueThe HTTP client disables TLS certificate verification. This is a common practice in security tools to allow scanning of sites with self-signed or misconfigured certificates, but it reduces transport security.
CVE-2026-47423.go:18
What the analysis did not establish
- One non-text media file (CVE-2026-47423.JPG) is present but not included as text, so its content cannot be analyzed.
- The analysis is based solely on static code review; the code was not executed, and its actual behavior or effectiveness is not verified.
- One non-text media file (CVE-2026-47423.JPG) was flagged as binary and not analyzed; its content is unknown.
- The review is limited to the two text files provided; any other files in the repository were not included in the evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.