-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in widget classes handling unit fields. The commit diffs show critical changes to the validator() method in these widgets:
These changes indicate the validator functions were previously allowing arbitrary 'unit' values without proper sanitization. The vulnerability manifests when user-controlled 'unit' values are rendered without escaping in both backend previews and frontend output. The high confidence comes from direct correlation between the patch changes and the XSS vulnerability description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| contao/core-bundle | composer | >= 4.0.0, < 4.9.42 | 4.9.42 |
| contao/core-bundle | composer | >= 4.10.0, < 4.13.28 | 4.13.28 |
| contao/core-bundle | composer | >= 5.0.0, < 5.1.10 | 5.1.10 |
PHPPHPOngoing coverage of React2Shell