-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cesium | npm | <= 1.111.0 |
Miggo AIRoot Cause AnalysisThe advisory explicitly states the XSS occurs via crafted payloads to /container_files/public_html/doc/index.html, but the vendor note clarifies the actual vulnerable component is Apps/Sandcastle/standalone.html. The GitHub Gist proof-of-concept confirms the root cause is improper handling of location.hash when creating script elements. While no specific named function is mentioned, the inline script logic in standalone.html that processes URL fragments to load scripts constitutes the vulnerable code path. This matches classic DOM-based XSS patterns where untrusted input (URL fragments) is used without sanitization for script execution.