-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the store.deep.js component's use of eval() in processing keys, as explicitly shown in GitHub issue #127. The proof-of-concept demonstrates XSS via crafted keys containing semicolons and alert() calls. The patch in PR #128 replaces eval() with a safe path resolution mechanism, confirming this was the vulnerable function. The combination of user-controlled input reaching eval() without proper sanitization creates the XSS vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| store2 | npm | < 2.14.4 | 2.14.4 |
Ongoing coverage of React2Shell