4 min read
UofTCTF 2026 — Pasteboard Writeup
DOMPurify is fine — the bug is a raw server-side sink plus DOM clobbering: I hijack window.renderConfig to force a throw, then use window.errorReporter.path.value to load an arbitrary script under strict-dynamic and exfiltrate the bot's cookie.
#CTF#Cybersecurity#XSS