-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| roundup | pip | < 1.4.20 | 1.4.20 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the @action parameter in cgi/client.py not being sanitized before being included in an error message. The GitHub commit diff shows the fix added cgi.escape(action_name) to the ValueError raised in get_action_class, confirming the lack of escaping was the root cause. The CVE description explicitly references the @action parameter and cgi/client.py, aligning with this function's role in processing actions. Other functions (e.g., in templating.py) were patched for XSS but relate to different CVEs (e.g., CVE-2012-6130).