-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rsshub | npm | < 1.0.0-master.c910c4d | 1.0.0-master.c910c4d |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the error message construction in parameter.js middleware. The original code used brief=${ctx.query.brief} in a template literal, embedding unescaped user input into HTML output. The patch removed the dynamic parameter value from the error message, confirming this was the XSS vector. The middleware function handling parameter validation is the clear entry point where unsanitized user input entered the output stream.
JavaScriptJavaScriptOngoing coverage of React2Shell