-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability was introduced in commit dbd1af5bf which modified the highlighter() function to handle HTML content. The new implementation uses a regex to find text nodes but performs unsafe string replacement with user-controlled 'text' parameter. This allows XSS when the search query matches part of an HTML tag's content. The CVE description explicitly cites the highlighter() function as the vulnerable component, and the commit diff shows insecure handling of HTML elements in highlighted text.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bootstrap-3-typeahead | npm | > 4.0.2 | |
| bassjobsen/bootstrap-3-typeahead | composer | > 4.0.2 |