-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| backdrop/backdrop | composer | < 1.24.2 | 1.24.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized text format names being rendered in the JavaScript-driven hint below content editors. The GitHub issue #6065 explicitly mentions that the text format name wasn't sanitized in this context, and the fix involved adding sanitization. In Backdrop/Drupal architecture, this functionality is typically handled by filter.js's updateTips method, which would directly manipulate DOM elements with unescaped input. The vendor's patch in 1.24.2 addressed this by sanitizing the name parameter here, confirming this as the vulnerable location.