-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | < 2.5.0 | 2.5.0 |
| dompurify | npm | >= 3.0.0, < 3.1.3 | 3.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient protection against nesting-based mXSS attacks. Key indicators from the commit diff show:- 1) Addition of MAX_NESTING_DEPTH constant and depth tracking properties (__depth/__removalCount)- 2) Modifications to node cloning to track removal counts- 3) Added depth checks in shadow DOM sanitization loops- 4) Enhanced clobbering detection. The vulnerable functions were those handling DOM traversal/cloning without these protections, allowing attackers to create deeply nested structures that bypassed sanitization through parser re-serialization quirks.