-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-draft-wysiwyg | npm | <= 1.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is triggered through the Embedded button functionality in the react-draft-wysiwyg Editor component. Based on the package's architecture and the PoC, the attack flow would involve: 1) handleEmbeddedLink processing the malicious input, 2) addEmbedded creating the iframe element, and 3) render displaying the content. These functions would appear in the call stack during exploitation. The confidence is high for handleEmbeddedLink as it's the primary input handler, and medium for the others as they're involved in the processing chain but might not directly contain the vulnerability.
JavaScriptJavaScriptOngoing coverage of React2Shell