-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input sanitization in the ViewSource plugin's HTML processing. The commit adds a new _stripEventHandlers function and integrates it into the existing _filter function through a conditional check. Since the vulnerability specifically involves failure to remove on* attributes, and the patch modifies _filter to include this new sanitization step, the unpatched _filter function is directly responsible for the XSS vulnerability. The test cases added in the commit also explicitly verify event handler stripping behavior, confirming this was the missing security control.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dijit | npm | < 1.13.1 | 1.13.1 |