-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| izimodal | npm | < 1.6.1 | 1.6.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from inserting user-controlled input (title/subtitle/iconText/content) into DOM via .html() without proper sanitization. The commit patched this by introducing a sanitize() function that removes dangerous attributes/patterns, and applied it to all these insertion points. The functions shown in the diff that received sanitize() wrappers were previously vulnerable to XSS through their parameters.