-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hexo-admin | npm | <= 2.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user input being rendered as HTML in multiple admin interface components. The pull requests (GHSA-g784-q3p3-26rm, #203) explicitly show fixes using DOMPurify in client-side JavaScript files to sanitize post content before rendering. While exact function names aren't disclosed, the pattern of: 1) content editing handlers, 2) preview rendering, and 3) post list display matches the vulnerability description and patch locations. The high confidence comes from direct correlation between the described XSS vectors and the areas modified in the security patches.