-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | >= 1.31.0, < 1.31.9 | 1.31.9 |
| mediawiki/core | composer | >= 1.32.0, < 1.34.3 | 1.34.3 |
| mediawiki/core | composer | >= 1.35.0-rc.0, < 1.35.0 | 1.35.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability arises from two key flaws: (1) The extlink handler in jqueryMsg's HtmlEmitter did not sanitize URLs, permitting 'javascript:' links. The patch explicitly checks for valid protocols. (2) The isAllowedHtml function allowed unsafe style attributes. Both functions were directly modified in the security patch (T86738), and their pre-patch behavior aligns with the described XSS vector. The Phabricator ticket and commit diffs confirm these as the root causes.
Ongoing coverage of React2Shell