-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized cell content rendering. Since the package handles spreadsheet data display, the core cell rendering function would be responsible for outputting user-controlled values to the DOM. The provided PoC demonstrates that raw HTML/JS in cells executes when rendered, indicating the renderer doesn't sanitize outputs. While exact code isn't available, cell rendering components are the logical location for this vulnerability given the XSS through cell input description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| x-data-spreadsheet | npm | <= 1.1.9 |
Ongoing coverage of React2Shell