-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise-embed | npm | < 2.0.0 | 2.0.0 |
| flowise | npm | < 2.1.1 | 2.1.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The renderArtifacts() function directly injected unsanitized content via innerHTML, including HTML artifacts and Markdown-parsed content. 2) The Marked parser was initially configured without sanitization (commit diff shows added 'sanitize: true' in Marked.setOptions). This combination allowed stored XSS via chat messages containing JavaScript payloads. The Tenable PoC demonstrates this with <iframe src=javascript:...> payloads being executed in the admin panel/modules/plugins/. The fixes in 6a9645d address both aspects by adding sanitization to the Marked parser and implementing proper artifact handling.
KEV Misses 88% of Exploited CVEs- Get the report