-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| starcitizentools/citizen-skin | composer | >= 2.6.3, < 2.31.0 | 2.31.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped insertion of user-provided 'realname' into HTML output. The offending code in CitizenComponentUserInfo.php line 137 (pre-fix) used $user->getRealName() without escaping. The subsequent patch in commit 86da3e0 added htmlspecialchars() to both getRealName() and getName(), confirming the lack of output encoding was the root cause. The getUserPage method constructs the user info HTML using these unsanitized values, making it the primary vulnerable function.
Ongoing coverage of React2Shell