-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @tutao/tutanota-utils | npm | < 314.251111.0 | 314.251111.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the ContactViewer.ts file, where several private methods (_renderSocialId, _renderWebsite, _renderMessengerHandle, _renderPhone, _renderAddress) were using string concatenation to build Mithril hyperscript selectors. This is a classic injection vulnerability. An attacker could craft a contact with a malicious value in one of the fields (e.g., social ID, website URL). When the contact is viewed, the malicious string would be embedded into the selector, allowing the attacker to inject arbitrary HTML attributes and CSS. This could be used to, for example, create a large, invisible link that covers the entire screen and points to a malicious website, tricking the user into clicking it.
The patch fixes this by changing the Mithril hyperscript calls from m('a[href=...]') to m('a', { href: ... }). This latter form is safe from injection because Mithril treats the attributes as a data object and properly escapes them, rather than parsing them from a string. The identified functions are the ones that contained these vulnerable calls and would be on the call stack when a malicious contact is rendered.
ContactViewer._renderSocialIdsrc/mail-app/contacts/view/ContactViewer.ts
ContactViewer._renderWebsitesrc/mail-app/contacts/view/ContactViewer.ts
ContactViewer._renderMessengerHandlesrc/mail-app/contacts/view/ContactViewer.ts
ContactViewer._renderPhonesrc/mail-app/contacts/view/ContactViewer.ts
ContactViewer._renderAddresssrc/mail-app/contacts/view/ContactViewer.ts
A Semantic Attack on Google Gemini - Read the Latest Research