-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dash-core-components | npm | < 2.13.0 | 2.13.0 |
| dash | pip | < 2.15.0 | 2.15.0 |
| dash-html-components | npm | < 2.0.16 | 2.0.16 |
| dash-html-components | pip | < 2.0.0 | 2.0.0 |
| dash-core-components | pip | < 2.0.0 | 2.0.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsanitized href/action/src attributes in multiple components. The commit diff shows: 1) In Link.react.js, href was directly used without validation before adding @braintree/sanitize-url. 2) generate-components.js was modified to add sanitization for multiple HTML elements' attributes, indicating these were previously vulnerable. Both locations handled user-controlled URL values without proper neutralization of JavaScript URIs, enabling XSS when malicious values were stored and rendered.
Ongoing coverage of React2Shell