-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues in SSR attribute handling: 1) escape_attribute_value previously only escaped string values, leaving objects (including those with custom toString()) unescaped. 2) add_attribute directly used value.toString() without sufficient escaping. The patch addresses both by modifying escape_attribute_value to handle objects and changing add_attribute to use the escape function directly. The commit diff shows these functions were modified to fix improper attribute escaping, confirming their role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| svelte | npm | < 3.49.0 | 3.49.0 |
Ongoing coverage of React2Shell