-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from client-side notification handling improperly handling HTML escaping. The advisory specifically mentions the JS notification module unescapes server-provided content. The '_addNotification' function would be responsible for DOM insertion of notifications, and the XSS occurs when user-controlled input (like workspace/media titles) is passed through this path without proper escaping. While exact code isn't available, the pattern matches common XSS vectors in notification systems where server-provided content is rendered as HTML without sanitization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| neos/neos | composer | >= 3.3, < 5.3.10 | 5.3.10 |
| neos/neos | composer | >= 7.0.0, < 7.0.9 | 7.0.9 |
| neos/neos | composer | >= 7.1.0, < 7.1.7 | 7.1.7 |
| neos/neos | composer | >= 7.2.0, < 7.2.6 | 7.2.6 |
| neos/neos | composer | >= 7.3.0, < 7.3.4 | 7.3.4 |
| neos/neos | composer | >= 8.0.0, < 8.0.2 | 8.0.2 |