-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped filename insertion in up2k.js's message construction logic. The GitHub patch shows the addition of esc() calls around bad_files[a][1] and nil_files[a][1] in up2k_init, proving these were the vulnerable points. These locations directly used user-controlled filenames in HTML context without sanitization, enabling DOM XSS when empty files with malicious names were dragged into the UI.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| copyparty | pip | < 1.16.15 | 1.16.15 |
KEV Misses 88% of Exploited CVEs- Get the report