Is this javascript vulnerable to dom based XSS?

Question

I was testing example.com and i found a js reflection point. If i send the following request:

https://example.com/?token=test%22test="'-confirm(1)-'

I can see the following in server response:

<script nonce="">
window.meta    = {
"token": "Token\"xss=\"'-confirm(1)-'",
"dToken": "dt\"xss=\"'-confirm(1)-'",
"Id": "11"
</script>

Is this code vulnerable to Dom Based XSS? If yes, which payload could i try to trigger an alert box?

I already tried to close the </script> tag but < and > are filtered.

Answer 1

No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. Because of this it is impossible to inject executable code, opposed to simply changing the content of a JavaScript string variable.

As you pointed out, it is also impossible to close/reopen the script tag.

As noted in the comments, if backslashes are not escaped (which we don't know), you can use an additional \ to escape the first backslash of \" so that it becomes \\" in which case you can break out of the string because the " character is now no longer escaped.