-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| golang.org/x/net | go | < 0.0.0-20210520170846-37e1c6afe023 | 0.0.0-20210520170846-37e1c6afe023 |
Miggo AIRoot Cause AnalysisThe commit 37e1c6a specifically modifies inHeadIM in html/parse.go to add checks for foreign content when processing <template> tags. The vulnerability manifests when parsing maliciously crafted ParseFragment inputs mixing foreign content and templates, which the original inHeadIM implementation couldn't handle properly. The added loop checking for non-empty namespaces in open elements and setting ignoreTheRemainingTokens directly addresses the infinite loop scenario. Test cases in parse_test.go (e.g., TestParseFragmentForeignContentTemplates) validate() this fix by ensuring such inputs no longer cause hangs.
Ongoing coverage of React2Shell