-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of HTML escaping in the lib/oxidized/web/views/conf_search.haml template when rendering the @to_research parameter. The commit diff explicitly adds escaping (&=) to this variable, confirming the original code was vulnerable. Since HAML templates are part of the view layer responsible for rendering user data, this unescaped interpolation directly enables XSS. No other functions are mentioned in the provided context, and the patch focuses solely on this template.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oxidized-web | rubygems | <= 0.13.1 |