-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| froala-editor | npm | <= 4.0.6 | 4.0.11 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests in the video insertion functionality where user-controlled embedded code is processed. The GitHub fix (418sec/wysiwyg-editor#1) shows the vulnerability was in line 188 of video.min.js where input sanitization was missing for dangerous URI schemes. The patch added .replace() calls to remove 'data:' and 'javascript:' prefixes, confirming the vulnerable code path handled unsanitized embed code insertion. The CVE description and reproduction steps specifically implicate the video embedding feature's input handling as the vulnerable component.
Ongoing coverage of React2Shell