MetricFlow — DOM XSS via Prototype Pollution Gadget

hackadvisor

Task: Analytics dashboard with client-side widget rendering; deepSet() parses URL query params with bracket notation without filtering __proto__. Solution: Prototype pollution via __proto__[headerTemplate] injects HTML into innerHTML gadget in renderWidget(), achieving DOM XSS to exfiltrate admin flag via shared notes API.