Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-39390

CVE-2022-39390:
Withdrawn: Octocat.js vulnerable to code injection

N/A

CVSS Score

Basic Information

CVE ID
CVE-2022-39390
GHSA ID
GHSA-r4jg-5v89-9v62
EPSS Score
-
CWE
CWE-74
Published
11/8/2022
Updated
2/24/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS metrics data is empty
Package NameEcosystemVulnerable VersionsFirst Patched Version
octocat.jsnpm< 1.21.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided information does not include specific code snippets, commit diffs, or file paths that would allow identification of exact vulnerable functions. While the vulnerability stems from improper handling of user-supplied image URLs in SVG rendering, the lack of code context prevents pinpointing the specific functions with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Wit**r*wn T*is **visory **s ***n wit**r*wn ****us* it is * t*st. ## Ori*in*l **s*ription ### Imp**t Us*rs **n in*lu** t**ir own im***s *or ****ssori*s vi* provi*** URLs. T**s* URLs *r* not v*li**t** *n* **n r*sult in *x**ution o* inj**t** *o**.

Reasoning

T** provi*** in*orm*tion *o*s not in*lu** sp**i*i* *o** snipp*ts, *ommit *i**s, or *il* p*t*s t**t woul* *llow i**nti*i**tion o* *x**t vuln*r**l* *un*tions. W*il* t** vuln*r**ility st*ms *rom improp*r **n*lin* o* us*r-suppli** im*** URLs in SV* r*n**