-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | <= 1.7.0 | 1.7.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped repository names in go-get URL generation. The fix in PR #5905 shows the HTMLMeta function in modules/context/repo.go was modified to apply template.HTMLEscapeString to ctx.Owner.Name and ctx.Repo.Name. This indicates these values were previously rendered raw, making the function vulnerable to XSS when processing malicious repository names in URLs.
A Semantic Attack on Google Gemini - Read the Latest Research