-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies page.open() as the entry point where URL handling occurs. Analysis of PhantomJS's source code shows that page.open() delegates to openUrl in webpage.cpp, which automatically sets the 'file://' scheme for unqualified paths. This behavior enables local HTML files to execute same-origin XHR requests to read arbitrary files, which are then captured via rendering callbacks. The advisory and code analysis both confirm page.open()'s role in enabling the exploit chain.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phantomjs | npm | <= 2.1.1 |
Ongoing coverage of React2Shell