-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| teler.app | go | >= 2.0.0-rc, <= 2.0.0-rc.3 | 2.0.0-rc.4 |
| teler.app | go | = 2.0.0-dev | 2.0.0-dev.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized use of innerHTML with user-controlled data in three key locations: 1) When populating category names (data.category), 2) When displaying matches (data[data.element]), and 3) When creating signature filter items (name parameter). The commit diff shows these were all modified to use a new escapeHTML function, confirming these were the vulnerable points. The lack of HTML entity escaping in these DOM manipulation operations directly enables DOM-based XSS.
GoGoOngoing coverage of React2Shell