-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| formidable | npm | < 3.2.4 | 3.2.4 |
Ongoing coverage of React2Shell
Miggo AIRoot Cause AnalysisThe core vulnerability stems from filename handling in Formidable's parsing logic. The GitHub PR #857 specifically modifies _getExtension to address extension validation, replacing a problematic regex with character-by-character validation. The _getFileName function's handling of quoted filenames and HTML entity decoding (shown in issue #862's test case) could allow crafted filenames to bypass security checks. While the vulnerability is disputed due to Formidable's intended low-level nature, these functions represent the technical root of the alleged vulnerability when used with default/unsafe configurations.