-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| loader-utils | npm | >= 1.0.0, < 1.4.2 | 1.4.2 |
| loader-utils | npm | >= 2.0.0, < 2.0.4 | 2.0.4 |
| loader-utils | npm | >= 3.0.0, < 3.2.1 | 3.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability was explicitly tied to the interpolateName function handling resourcePath through a vulnerable regex pattern. The GitHub patch shows the regex was modified from [^:]] to [^[]:] in the capture group, specifically to prevent ReDoS by reducing backtracking complexity. Multiple sources (CVE description, commit diff, advisory references) all point to this function and regex as the attack vector. The function's role in processing untrusted resourcePath values makes it the clear entry point for crafted malicious inputs.
JavaScriptJavaScriptOngoing coverage of React2Shell