-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @vendure/core | npm | < 2.0.3 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure default cookie configuration settings (specifically missing 'sameSite' attribute) in the default-config.ts file, rather than specific functions. The fix involved modifying the configuration object's cookieOptions property to set sameSite: 'lax'. While the cookie-session middleware's default behavior is implicated, there are no actual functions in Vendure's codebase that directly implement this behavior - the vulnerability arises from configuration values passed to a dependency rather than vulnerable function implementations within Vendure itself.
Ongoing coverage of React2Shell