-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tecnickcom/tcpdf | composer | < 6.8.0 | 6.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from TCPDF's error handling mechanism. The Error method in tcpdf.php directly outputs error messages through die() without sanitization. The GitHub commit shows the vulnerability was patched by adding htmlspecialchars() to the $msg parameter in this specific function. Since error messages can contain user-controlled data (like invalid font names from user input), the lack of escaping made XSS exploitation possible when errors occur. The direct correlation between the vulnerability description, CWE-79 classification, and the specific commit patching this function creates high confidence in this identification.
A Semantic Attack on Google Gemini - Read the Latest Research