GMSGadget (Give Me a Script Gadget) is a collection of JavaScript gadgets that can be used to bypass XSS mitigations such as Content Security Policy (CSP) and HTML sanitizers like DOMPurify.
It's important to note that this is not a list of exploits. The gadgets listed here are either patched vulnerabilities or intended JavaScript behaviors that can be leveraged to bypass HTML restrictions.
This repository is only here for contributors; please use the website to search through gadgets: https://gmsgadget.com/