-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerable code constructed an alert() message using only javascriptEncode(message). JavaScript string escaping (via javascriptEncode) doesn't prevent HTML/script context injection when the output is embedded in a <script> block. The patched version adds htmlEncodeButNotSpace(), demonstrating the original lacked proper contextual encoding for HTML. This matches the XSS vulnerability pattern where user input flows into a dangerous sink without adequate sanitization for the output context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.bull.javamelody:javamelody-core | maven | < 1.61.0 | 1.61.0 |
A Semantic Attack on Google Gemini - Read the Latest Research