Is there way to execute alert box if " is not correctly escaped and can be injected in example below?

<script type="application/json">{"requests":{"postClicked":"https://google.com"}</script>


<script type="application/json">{"requests":{"postClicked":"injection"}here"-alert()-"}</script>

I have tried several ways to break the string, but still failing to execute alert box.

  • Not inside an application/json box. However can you close the script and open a new one? Aug 10, 2020 at 16:42
  • nope, only " are not encoded and unescaped, so I tought XSS could be possible Aug 10, 2020 at 16:44

2 Answers 2


No but maybe.

You cannot directly execute JavaScript inside an application/json script tag, because the browser will not treat anything inside the tag as JavaScript. It is (unfortunately for you) that simple. Unless you can close the script tag and open a new one, there is no direct XSS here.

However injecting JSON data into a page like that is useless by itself. It only happens because the page will read the data from JSON and use it elsewhere. If by chance you can figure out when and where that gets used and find some improper data usage, then you may find a vulnerability yet. For reference here is an example of some vulnerable code with a simple alert demo.

<script type="application/json" id="test">{"title": "<img src=0 onerror=\"alert(1)\">"}</script>

<div id="title"></div>

<script type="text/javascript">
    var data = JSON.parse(document.getElementById('test').innerHTML);
    document.getElementById('title').innerHTML = data['title'];
  • This would be a standard example of DOM-based XSS, yep. Can also happen with inputs in other formats (e.g. XML) and from other locations (e.g. XHR or local storage). Tricky for scanners to detect directly because it isn't directly in the response anywhere, but easy to flag innerHtml or any of the common wrappers for it.
    – CBHacking
    Aug 19, 2021 at 2:10

If a malicious user controls the string ("https://google.com" in the initial example), it can certainly be broken out of and cause an alert (among other things) with a string like this:


Or included in the full example:

<script type="application/json">{"requests":{"postClicked":"</script><script>alert()</script>"}</script>

Roughly speaking, this is what's happening:

  • Close the original tag (prematurely)
  • Create a new (non-JSON) script tag
  • alert()
  • Close this newly-created script tag
  • Render the leftover "}
  • Discard the leftover </script>

Although there are certainly differences between type="application/json" and type="text/javascript", this blog post by Mathias Bynens should offer some more food for thought on the topic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .