-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rsshub | npm | < 1.0.0-master.a66cbcf | 1.0.0-master.a66cbcf |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from route handlers accepting user-controlled parameters to construct backend URLs without proper domain validation. The commit adds 'isValidHost' checks across multiple route files, indicating these handlers previously lacked validation. Each listed function corresponds to a route that was modified to add security checks, with their absence previously enabling SSRF through crafted parameters. The high confidence comes from direct correlation between added validation in the fix and previously missing security controls.
Ongoing coverage of React2Shell