-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spatie/browsershot | composer | < 3.40.1 | 3.40.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from how the Puppeteer instance handled URLs in bin/browser.js. The unpatched code directly passed user-controlled URLs to page.goto(), including file:// protocol URLs. The fix in commit 8d4bcfb introduced a check for file:// URLs and switched to page.setContent() for safer local HTML rendering. The PHP method Browsershot::html() created temporary files with file:// URLs, but the root vulnerability was in the JavaScript navigation logic.
PHPPHPOngoing coverage of React2Shell