-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from missing rel="noopener" attributes when setting target="_blank". The commit patching this vulnerability specifically modifies two areas: 1) The targetLinksToNewWindow function that processes all links, and 2) The HTML template literals generating interaction buttons. Both locations initially created links with target="_blank" without security attributes, making them vulnerable to window.opener exploitation. The named function targetLinksToNewWindow is explicitly vulnerable, while the interaction link generation (though part of inline template construction) represents a distinct vulnerable code path that was also patched.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| twitter-fetcher-js | npm | < 18.0.0 | 18.0.0 |
Ongoing coverage of React2Shell