-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @braintree/sanitize-url | npm | < 6.0.1 | 6.0.1 |
Miggo AIRoot Cause AnalysisThe patch modified 1) decodeHtmlCharacters to handle entities and 2) updated the urlSchemeRegex to detect :. The vulnerability manifests in these two areas: failure to normalize tab entities before decoding, and inability to detect HTML-encoded colons in protocol schemes. Both functions directly process attacker-controlled input and were missing critical entity handling pre-patch.