-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| quill-mention | npm | < 4.0.0 | 4.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key areas: 1) In quill.mention.js, the renderList method directly assigned renderItem output to li.innerHTML without sanitization. The commit replaced this with safe DOM manipulation methods. 2) In mention.js, the MentionBlot.create method used innerHTML for both denotation character and value insertion. The patch changed these to innerText and DOM node creation. Both functions handled user-controllable input without proper escaping, making them XSS vectors.