-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from how Zend_Filter_StripTags processes HTML attributes. The _validateAttributes method is responsible for checking allowed attributes using regular expressions that didn't account for whitespace/newlines around attribute assignment operators. This allowed malicious attributes like 'onclick' with line breaks around the '=' to bypass the whitelist check. The advisory specifically references attribute whitelisting functionality in this class as the vulnerable component, and the patched version (1.7.6) would have modified this validation logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | >= 1.7.0, < 1.7.6 | 1.7.6 |
Ongoing coverage of React2Shell