-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| erxes | npm | <= 1.0.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe XSS vulnerability arises from two connected components: 1) The route handler in index.ts directly passes user-controlled query parameter (topicId) to the template without sanitization. 2) The EJS template uses unescaped output (<%-) when embedding this value in a JavaScript context, allowing script injection. The combination of unsanitized input passing and dangerous output interpolation creates an XSS vector. GitHub's security advisory demonstrates concrete exploitation examples using this exact code path.
Ongoing coverage of React2Shell