-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| uptime-kuma | npm | >= 1.20.0, <= 1.23.6 | 1.23.7 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from improper contextual escaping in the Google Analytics script generation. The pre-patch code used jsesc with {isScriptContext: true} which handles JavaScript string escaping but not HTML attribute escaping. The attack payload demonstrates attribute injection in the script tag's src attribute (via id=${escapedTagId}), which was only JS-escaped not HTML-escaped. The fix introduced html-escaper for HTML attribute context, confirming the vulnerability existed in this function's handling of the tagId parameter.
Ongoing coverage of React2Shell