-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lxml | pip | < 4.2.5 | 4.2.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient handling of encoded JavaScript URLs in the HTML sanitizer. The commit 6be1d08 shows the fix was applied to _remove_javascript_link by adding unquote_plus() to decode URLs before whitespace substitution. This function's pre-patch version only performed whitespace substitution without URL decoding, making it vulnerable to obfuscated 'javascript:' schemes. The test case changes in test_clean.txt demonstrate this was the attack vector. The function's direct responsibility for URL sanitization and the explicit patch confirm its vulnerability.