-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the processContent function handling user-controlled content without sanitization. The commit diff shows the vulnerable version concatenated raw content into HTML strings and used jQuery.mark() without escaping, while the patched version added text-based sanitization. The CWE-79/CWE-80 mapping and added test case confirming HTML escaping further validate() this as the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| govuk_tech_docs | rubygems | >= 2.0.2, < 3.3.1 | 3.3.1 |
RubyRubyOngoing coverage of React2Shell