-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the combination of: 1) User-controlled input (tag names) being directly inserted into HTML via replaceAll, and 2) Use of React's dangerouslySetInnerHTML which bypasses XSS protections. The patch replaces this dangerous pattern with safe React element composition. The pre-patch code clearly shows the vulnerable pattern in the highlightedText generation and rendering logic.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sulu/sulu | composer | >= 2.0.0, < 2.4.16 | 2.4.16 |
| sulu/sulu | composer | >= 2.5.0, < 2.5.12 | 2.5.12 |
Ongoing coverage of React2Shell