-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from incomplete sanitization in script return value handling. The commit diff shows the patched version added resolveTypeAndSanitize() to recursively sanitize List/Map elements, while the original code (shown in the patch's '-' lines) only sanitized CharSequence types. This matches the CVE description about unescaped List/Map values in Reactive Reference Parameters. The eval function is the entry point for script evaluation and was the root cause of insufficient escaping.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.biouno:uno-choice | maven | < 2.5 | 2.5 |
JavaJavaOngoing coverage of React2Shell