-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-react-sdk | npm | < 3.71.0 | 3.71.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key functions: 1) bodyToHtml failed to escape plaintext messages before passing them to the highlighter, as shown in the diff adding escapeHtml(plainBody). 2) applyHighlights' JSDoc explicitly states it requires sanitized input but was receiving raw user-controlled data. The combination allowed HTML injection when plaintext messages containing HTML tags were highlighted in search results. The commit fixes this by adding HTML escaping in bodyToHtml before calling applyHighlights.
Ongoing coverage of React2Shell
JavaScriptJavaScript