-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| CherryMusic | pip | < 0.36.0 | 0.36.0 |
Miggo AIRoot Cause AnalysisThe GitHub patch shows the XSS fix in playlistmanager.js where they added HTML escaping for the playlist name. The original vulnerable code constructed DOM elements by directly embedding pl.name into HTML without sanitization (line: pltabs += '<a...>' + pl.name). This matches the vulnerability description of XSS via playlistname field. The httphandler.py changes relate to a different CVE (file traversal), leaving the playlistmanager.js modification as the clear XSS fix.