-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Umbraco.Cms.Infrastructure | nuget | < 15.0.0 | 15.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Umbraco's decision not to enforce server-side sanitization in the Rich Text Editor (RTE) by default. The key functions are: 1) DatabaseDataCreator.CreateDefaultData, which configured TinyMCE as the default RTE (vulnerable in <15.0.0), and 2) RichTextPropertyValueEditor, which handles RTE content rendering. The patch in v15.0.0 replaced TinyMCE with Tiptap, suggesting the issue was tied to TinyMCE's implementation. The lack of automatic sanitization in these components allowed stored XSS when rendering untrusted RTE content.
Ongoing coverage of React2Shell