-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped interpolation of item.group_label in the choice_label method. The patch adds this.escape_html() to sanitize this input. The commit diff shows the vulnerable line was rendering raw group_label into HTML via string interpolation, while the fixed version applies HTML escaping. The added test cases specifically validate XSS prevention in this context, confirming this function as the injection point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| harvesthq/chosen | composer | < 1.8.7 | 1.8.7 |
PHPPHPOngoing coverage of React2Shell