-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prestashop/prestashop | composer | >= 8.0.0-beta.1, < 8.1.3 | 8.1.3 |
| prestashop/prestashop | composer | < 1.7.8.11 | 1.7.8.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incomplete HTML sanitization in multiple implementations of isCleanHtml validation. The PHP Validate class and JavaScript implementations both missed: 1) Generic pattern matching for any attribute starting with 'on' (event handlers) 2) Right-to-Left Override character detection. The commit diffs show these were the exact patterns added in patches (script5 regex for 'on\w+' attributes and RLO checks). These functions were directly responsible for XSS filtering and their incomplete validation allowed dangerous attributes to pass through.
PHPPHPOngoing coverage of React2Shell