-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper protocol validation in the redirect logic. The pre-patch code in service.tsx checked if the protocol was NOT http/https to allow redirects, which inadvertently permitted XSS vectors. The patch introduced a strict allowlist (vscode:, vscode-insiders:, jetbrains-gateway:), confirming the original vulnerability existed in this protocol check function. The code modification directly addresses the XSS vulnerability by restricting allowed protocols.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gitpod-io/gitpod | go | < 2022.11.3 | 2022.11.3 |
Ongoing coverage of React2Shell