-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | >= 6.6.0, < 6.6.1 | 6.6.1 |
| github.com/mattermost/mattermost-server | go | >= 6.5.0, < 6.5.1 | 6.5.1 |
| github.com/mattermost/mattermost-server | go | >= 6.4.0, < 6.4.3 | 6.4.3 |
| github.com/mattermost/mattermost-server | go | >= 5.0.0, < 6.3.8 | 6.3.8 |
Miggo AIRoot Cause AnalysisThe GitHub PR #19988 shows a critical change from xml.Decoder.Decode() to Token()-based parsing in svg.go. The Decode method parses the entire XML structure recursively, which is vulnerable to 'billion laughs' attacks or deeply nested SVG elements that cause excessive resource consumption. The removal of regex-based fallback checks (viewBox/width/height) further indicates the original implementation lacked proper validation. The CVE description explicitly links SVG parsing to server crashes, aligning with this code change.
Ongoing coverage of React2Shell