-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmct | npm | <= 3.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of user-controlled input (domainObject.name) in the flexibleLayout plugin. The commit diff shows the vulnerable code used 'this.dragGhost.innerHTML = <span>${this.domainObject.name}</span>' which directly injected unescaped user input into DOM. This matches the advisory's description of XSS via new component feature in flexibleLayout. The fix replaced this with safe DOM manipulation using textContent and appendChild, confirming the vulnerability location.