-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using getAttribute() directly on width/height attributes without sanitization. The commit 1249057 shows replacement with getElemAttr which performs safe attribute retrieval. Multiple sources (CVE, GHSA, Snyk) confirm these functions as vulnerable entry points. The PoC demonstrates XSS execution through manipulated width attribute values processed by these functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tarteaucitronjs | npm | < 1.17.0 | 1.17.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell