-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability was addressed in commit ea254ee by removing these custom highlighting functions entirely. The DOM-based XSS stemmed from how user-controlled input from URLs was processed and persisted in query history. The JavaScript highlight() function directly manipulated DOM elements with unsanitized input, while the Go function() generated unsafe HTML output. Both were replaced with proper sanitization via prism.js in the fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/prometheus/prometheus | go | < 2.7.1 | 2.7.1 |