-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | < 1.0.11 | 1.0.11 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the demo's afterSanitizeElements hook in hooks-target-blank-demo.html. This hook added 'target="_blank"' to links but did not include the 'rel="noopener noreferrer"' attribute, which is critical to prevent reverse tabnabbing. The patch explicitly adds this attribute in the same hook, confirming the vulnerable code location. The core DOMPurify library is not inherently vulnerable; the issue was specific to the demo's example implementation.