-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmct | npm | <= 3.1.0 | 3.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe HTML injection in the flexibleLayout plugin's drag ghost element creation. The commit diff shows the fix replaced innerHTML with safe DOM manipulation methods (createElement/textContent). While the CVE describes CSRF, the root cause is XSS in Frame.vue that enables CSRF exploitation. The vulnerable function handles drag operations using user-controlled domainObject.name without proper sanitization, allowing script execution that could forge authenticated requests.