-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) Unsafe handling of user-controlled input in iframe srcdoc construction (via getEmbedLink), and 2) Improper sandbox policy management tied to domain validation (via validateHostname). The commit diff shows critical changes to these functions - introducing strict allowlists (ALLOW_SAME_ORIGIN set), modifying sandbox attribute handling, and replacing direct srcdoc insertion with controlled construction. The pre-patch versions of these functions lacked proper input sanitization and least-privilege sandbox policies, enabling the XSS vectors described.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @excalidraw/excalidraw | npm | >= 0.16.0, < 0.16.4 | 0.16.4 |
| @excalidraw/excalidraw | npm | >= 0.17.0, < 0.17.6 | 0.17.6 |
Ongoing coverage of React2Shell