-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mootools-more | npm | <= 1.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the parseQueryString function's handling of query parameters. The code uses unvalidated user input to create object properties through path traversal (keys array processing). The PoC demonstrates that supplying proto or constructor[prototype] in query parameters pollutes the base object prototype. The GitHub advisory and NVD description both confirm this is the attack vector, and the BlackFan analysis explicitly shows the vulnerable code path in String.QueryString.js line 46.
Ongoing coverage of React2Shell