-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete URL encoding in the 'urlescape' template variable formatter. The first patch added this formatter using escape(), which doesn't properly encode all characters (like '+' or parentheses). The second patch replaced it with a proper percent-encoding implementation via encodeURIQueryValue(). The formatValue method with 'urlescape' handling would process user input without adequate escaping when invoked through template variable interpolation in text panels, making it the direct vulnerable function visible in execution traces during exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 6.0.0-beta1 | 6.0.0-beta1 |
Ongoing coverage of React2Shell