-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from validateProp's insecure implementation of URL validation. The function checked if href/src values started with dangerous protocols (javascript: etc.) using value.toLowerCase().startsWith(prefix) on the raw input. This failed to account for HTML entity encoding in the URL (e.g., jav ascript:), which would decode to a valid javascript: protocol after HTML parsing. The patch introduced a new isAnchorLinkAllowed function that properly decodes and sanitizes the URL before validation, confirming the weakness was in validateProp's original implementation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @nuxtjs/mdc | npm | <= 0.13.2 | 0.13.3 |
You may infer the following write-up for more in-depth walkthrough of URL parsing problems and suggestions on how to securely address them: How to Parse URLs from Markdown to HTML Securely?
Ongoing coverage of React2Shell