-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mxgraph | npm | <= 4.0.0 | 4.0.1 |
Miggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was in Dialogs.js where color input validation was added. The pre-patch code (lines 204-215) directly used user-provided color values without proper sanitization, allowing injection of event handlers like onMouseOver. The PoC demonstrates this by injecting JavaScript through the color field. The fix added regex validation for hex color formats, confirming the vulnerability existed in the color processing logic of this dialog handler.