-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that commit 960f0e2 introduced a possible XSS vulnerability. The commit details show modifications to the htmlAttrDumpOutput function in HTMLtree.c. The patch diff clearly indicates that the logic for handling server-side includes (<!-- ... -->) was altered to not URI escape their content when they appear within certain HTML attributes. The commit message itself, "Do not URI escape in server side includes," confirms this intent. The mail archive link further explains how this behavior can lead to XSS by allowing unescaped script tags within attributes like href. Therefore, htmlAttrDumpOutput is the function that, after this commit, processes and outputs potentially malicious input (the SSI content) without sufficient escaping, making it the vulnerable function.
Ongoing coverage of React2Shell