-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows XSS when previewing files with a .py extension that contain JavaScript code within <script> tags. The provided patch modifies the MdPreview function in src/pages/home/previews/markdown_with_word_wrap.tsx. This function is responsible for displaying file previews.
The core of the fix is the addition of the ext={ext(objStore.obj.name)} prop to the Markdown component within MdPreview. This implies that prior to the patch, the Markdown component (or the way MdPreview used it) did not correctly distinguish or handle different file types, particularly non-Markdown files like .py. As a result, it would interpret HTML-like tags (e.g., <script>) within these files, leading to XSS.
The MdPreview function is identified as vulnerable because it was the component directly responsible for invoking the rendering logic in a way that was susceptible to this XSS. While the Markdown component is where the misinterpretation likely happened, the patch is applied to MdPreview, indicating that MdPreview's usage of Markdown was the point of failure addressed. During exploitation, a stack trace would likely show MdPreview as part of the call chain leading to the unsafe rendering of the .py file content.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @openlist-frontend/openlist-frontend | npm | <= 4.0.0-rc.3 | 4.0.0-rc.4 |
A Semantic Attack on Google Gemini - Read the Latest Research