-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| loader-utils | npm | >= 1.0.0, < 1.4.2 | 1.4.2 |
| loader-utils | npm | >= 2.0.0, < 2.0.4 | 2.0.4 |
| loader-utils | npm | >= 3.0.0, < 3.2.1 | 3.2.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the regex pattern in interpolateName.js's interpolateName function, which was modified in the security patch (commit 17cbf8f). The original regex allowed catastrophic backtracking due to the [^:]] character class, which was tightened to [^[:]] in the fix. This function is explicitly referenced in CVE-2022-37603's description and GitHub advisory as the attack vector.
Ongoing coverage of React2Shell