-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @jitbit/htmlsanitizer | npm | < 2.0.3 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from a regex replacement in the output processing chain that ran AFTER initial sanitization. The commit diff shows removal of a <br> beautification line (/.replace(/<br[^>]*>(\S)/g, "<br>\n$1")/) which was located in the final HTML generation path. This post-sanitization modification created an XSS vector by altering sanitized content in ways that could reintroduce executable context. The function responsible for generating the sanitized output in HtmlSanitizer.js is the vulnerable entry point.