-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient sanitization when generating message previews in the conversation overview. The commit diff shows the patch added a check for '<' characters in the messagePreview variable derived from lastMessage.text. Prior to this fix, the code returned the text content without validating against HTML/script tags, making it possible for XSS payloads to execute when rendered. The vulnerable logic resides in the message drawer's overview section processing, specifically in the handling of lastMessage.text content.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | = 3.8 | 3.8.1 |
PHPPHPOngoing coverage of React2Shell