-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe provided code snippet from Gitee issue I8M1C2 shows direct string concatenation of user-controlled 'content' into a data-content attribute without proper escaping. This matches the CVE description of XSS via data-content parameter. While exact function names/paths aren't shown, the pattern matches table rendering logic in Layui's source where column templates are processed. The vulnerability is confirmed by the patch version bump and advisory details about improper input neutralization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| layui | npm | <= 2.7.4 | 2.7.5 |
JavaScriptJavaScriptOngoing coverage of React2Shell