-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing origin validation in WebSocket handlers across multiple endpoints. The patch added 'ensureOrigin' checks to these routes, which: 1) Validate Origin header against Host/X-Forwarded headers 2) Handle Forwarded header parsing 3) Block requests with mismatched origins. The vulnerable versions lacked these checks in their WebSocket handlers, particularly visible in routes like domainProxy.ts (lines 78-86), pathProxy.ts (line 50), and vscode.ts (line 173) where WebSocket handlers were modified to add origin validation middleware. The absence of these checks in pre-4.10.1 versions allowed cross-origin WebSocket hijacking.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code-server | npm | < 4.10.1 | 4.10.1 |
Ongoing coverage of React2Shell