-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @jmondi/url-to-png | npm | < 2.0.3 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key points: 1) The zodStringUrl validation in schema.ts lacked protocol restrictions, allowing 'file://' URIs. 2) The middleware propagated these invalid URLs to Playwright. The commit fixed both by adding protocol validation in schema.ts and improving error messaging in the middleware. The tests added for file:// URLs confirm these were the attack vectors. Both components directly handled the untrusted input without proper sanitization pre-patch.
Ongoing coverage of React2Shell