-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @kindspells/astro-shield | npm | >= 1.2.0, < 1.3.2 | 1.3.2 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability arises from improper validation of SRI hashes for injected resources. The updateDynamicPageSriHashes function is directly responsible for processing dynamic content and adding hashes to the CSP header. Pre-patch, it allowed non-allow-listed resources with valid integrity attributes to be included in the CSP, bypassing allow-lists. The scanAllowLists function's lack of optional chaining (patched to use ?? []) suggests it might fail to process allow-lists correctly, but this is a secondary factor. The primary vulnerability lies in the dynamic processing logic trusting unvalidated integrity hashes.
Ongoing coverage of React2Shell