-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tsup | npm | <= 8.3.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from tsup's handling of import.meta.url in browser contexts. The getImportMetaUrl function in cjs_shims.js directly references document.currentScript.src, which can be clobbered by attacker-controlled DOM elements (e.g., <img name='currentScript'>). This bypasses security checks as the code doesn't verify if document.currentScript is a valid <script> element. The GitHub Gist proof-of-concept and technical analysis confirm this pattern matches known DOM Clobbering attack vectors.
Ongoing coverage of React2Shell