-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| qwc2 | npm | < 2025.08.14 | 2025.08.14 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic Cross-Site Scripting (XSS) issue caused by rendering untrusted data directly into the DOM without proper sanitization. The patch for this vulnerability reveals that the problem was not isolated to a single component but was present across multiple React components in the QWC2 application.
The primary indicator of the vulnerability is the use of dangerouslySetInnerHTML in React, which is explicitly named to warn developers about the risk of XSS. The patch systematically adds DOMPurify.sanitize() to all instances where dangerouslySetInnerHTML is used with potentially user-controllable data. This includes data from layer information, search results, service information, theme descriptions, and map copyright information.
In addition to dangerouslySetInnerHTML, the TextInput component was also found to be vulnerable due to direct manipulation of the innerHTML property of a DOM element. This is another common XSS vector that was addressed in the patch.
The identified vulnerable functions are the render methods of the affected components, as well as specific methods in the TextInput component (setDefaultValue and onChange). These are the functions that would be in the call stack when the vulnerable code is executed and would be the most relevant indicators for a runtime profiler during exploitation.
LayerInfoWindow.rendercomponents/LayerInfoWindow.jsx
SearchBox.rendercomponents/SearchBox.jsx
ServiceInfoWindow.rendercomponents/ServiceInfoWindow.jsx
ThemeList.rendercomponents/ThemeList.jsx
TextInput.setDefaultValuecomponents/widgets/TextInput.jsx
TextInput.onChangecomponents/widgets/TextInput.jsx
MapCopyright.renderplugins/MapCopyright.jsx
JavaScriptJavaScriptOngoing coverage of React2Shell