-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| geminabox | rubygems | < 0.13.6 | 0.13.6 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from unescaped insertion of spec.homepage into href attributes in ERB templates. The commit diff shows the addition of the h helper (using Rack::Utils.escape_html) to sanitize spec.homepage. Prior to the patch, the absence of escaping allowed attackers to inject arbitrary HTML/JavaScript via the gem.homepage field. The ERB templates gem.erb and index.erb were the points of injection, making them the vulnerable components.
A Semantic Attack on Google Gemini - Read the Latest Research