{
  "id": 9812700,
  "title": "I uploaded a green square to a Next.js store and got stored XSS",
  "url": "https://urgent.news/2026/09/25/i-uploaded-a-green-square-to-a-next-js-store-and-got-stored-xss",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-25T19:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/oopssec-store/i-uploaded-a-green-square-to-a-nextjs-store-and-got-stored-xss-53i5"
  },
  "original_language": "en",
  "account": "In OopsSec Store, an admin panel allows uploading product images, including SVGs. Because SVG files are XML, malicious JavaScript can be embedded within them. By uploading a malicious SVG containing a script tag, an attacker can execute JavaScript code in the browsers of every visitor who views the infected product page. Two ways to gain admin access include SQL injection to obtain the admin password hash or weak MD5 hashing to crack the admin password.\n\nTo reproduce this exploit, first set up OopsSec Store using either Node.js or Docker. Log in as an admin and navigate to the admin product image editor. Create an SVG file with a script tag that displays an alert message, then upload it to a product. Once uploaded, the stored XSS attack will trigger, executing the malicious JavaScript for all visitors. The server initially validates the file type based on the Content-Type header, which the attacker can manipulate easily. The frontend then renders the SVG using the object tag, which, unlike an img tag, allows the embedded script to run.\n\nTo remediate the vulnerability, ensure the server inspects the actual file bytes rather than relying solely on the Content-Type header. This step alone would prevent the malicious SVG from executing JavaScript. Additionally, maintain a whitelist of allowed file types and implement content scanning to ensure only safe file formats are accepted.",
  "summary": "Upload a malicious SVG to the admin product image field and get stored XSS that fires for every visitor. The admin panel in OopsSec Store lets you upload product images, including SVGs. Since SVG is just XML, you can embed a <script> tag in one, upload it as a product image, and the JavaScript runs in the browser of anyone who views that product. Prerequisites You need admin access. Two attack…",
  "key_points": [
    "Malicious SVG file uploaded to Next.js store enables stored XSS.",
    "Admin access gained via SQL injection or weak MD5 hashing.",
    "Server must inspect file bytes, not just Content-Type header."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}