-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs in the credential endpoint handler that directly reflects the user-supplied 'id' parameter in error messages without proper sanitization. The code pattern matches security advisory examples showing unsanitized parameter reflection (res.status(404).send(Credential ${req.params.id} not found)). This is a textbook reflected XSS scenario where attacker-controlled input gets rendered in HTML responses. The GitHub Security Lab report (GHSL-2023-248) specifically identifies this endpoint as vulnerable, and the line numbers in referenced code match error response patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | <= 1.4.3 |
Ongoing coverage of React2Shell