-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2-p2 | 2.3.2-p2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch implementation of escapeXssInUrl which directly passed user input to escapeScriptIdentifiers without first decoding HTML entities. The commit c6ab7ac fixes this by adding html_entity_decode() before escaping, and the accompanying test case demonstrates protection against encoded payloads (e.g., e... becomes 'example.com'). This function was directly modified in the security patch and is explicitly referenced in vulnerability descriptions as the bypass target.
A Semantic Attack on Google Gemini - Read the Latest Research