-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| undici | npm | <= 5.8.1 | 5.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how URL construction was handled in two key functions:
path/pathname was directly passed to URL constructor with origin as base, but absolute paths would override the base.new URL(path, origin) pattern. The commit fixes show both locations were modified to enforce path sanitization (prepending slashes) and use string concatenation instead of relying on URL constructor's base parameter, confirming these were the vulnerable points.Ongoing coverage of React2Shell