-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ghtml | npm | < 2.0.0 | 2.0.0 |
Miggo AIRoot Cause AnalysisThe core vulnerability stems from the html function's escaping implementation in src/html.js. While it escaped basic HTML characters (<, >, &, ', "), it didn't account for all XSS contexts like: 1) unquoted HTML attributes, 2) JavaScript execution contexts, 3) URL attributes with javascript: schemes. The commit diff shows expanded escaping (including backticks) and documentation changes warning about incomplete XSS protection. The html function is the primary entry point for template processing, and its insufficient escaping logic directly enables XSS when user input is used in vulnerable contexts despite the basic escaping.