-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tinymce | npm | >= 6.0.0, < 6.3.1 | 6.3.1 |
| tinymce/tinymce | composer | >= 6.0.0, < 6.3.1 | 6.3.1 |
| TinyMCE | nuget | >= 6.0.0, < 6.3.1 | 6.3.1 |
| tinymce | npm | < 5.10.7 | 5.10.7 |
| tinymce/tinymce | composer | < 5.10.7 | 5.10.7 |
| TinyMCE | nuget | < 5.10.7 | 5.10.7 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsanitized HTML insertion in dialog messages. The commit diff shows the patched version added HtmlSanitizer.sanitizeHtmlString() to the message rendering path in Dialogs.ts. The original vulnerable code (before 5.10.7/6.3.1) lacked this sanitization. The pBodyMessage function was responsible for constructing dialog content and passed raw user-controlled HTML to the DOM, making it the primary vulnerable function. The CVE description explicitly calls out WindowManager.alert/confirm APIs as the vulnerable entry points, which use this rendering path.
KEV Misses 88% of Exploited CVEs- Get the report