-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oro/commerce | composer | >= 5.0, < 5.0.4 | 5.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient class name validation in the third-party GrapeJS library (specifically in its Selector Manager component), not from OroCommerce's own code. The advisory explicitly states that updating the GrapeJS dependency to >=v0.19.5 resolves the issue, indicating the root cause lies within GrapeJS's internal class name handling functions. Since the affected package (oro/commerce) merely uses this vulnerable dependency rather than implementing the flawed validation logic itself, no specific vulnerable functions within OroCommerce's codebase can be identified with high confidence.