-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch code in textarea.js where inputValue was directly assigned to innerHTML. The commit d70b0e0 explicitly fixes XSS by replacing innerHTML with innerText, indicating this was the injection point. While the exact method name isn't visible in the diff snippet, the code structure shows it was part of the component's auto-size text element update logic. The direct use of user-controlled inputValue in innerHTML without sanitization creates a classic DOM-based XSS vector, which matches the described CWE-79 vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vxe-table | npm | < 3.7.10 | 3.7.10 |