-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the AddOrUpdate function's recursive merging logic. The patch adds two critical validations: 1) explicit exclusion of proto and constructor keys, and 2) hasOwnProperty check to prevent prototype chain pollution. In vulnerable versions, this function would appear in profiler traces when processing malicious custom text inputs due to its role in deep-merging user-controlled objects. The function's full namespace is visible in the patch as tarteaucitron.AddOrUpdate, and it's explicitly referenced in the security advisory as the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tarteaucitronjs | npm | < 1.20.1 | 1.20.1 |
Ongoing coverage of React2Shell