-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ssddanbrown/bookstack | composer | < 0.30.4 | 0.30.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient HTML sanitization in the escapeScripts method. The GitHub patch adds specific XPath queries to remove dangerous elements (links with javascript: URIs, forms with javascript: actions, and redirect meta tags), which were previously not sanitized. The test cases in PageContentTest.php demonstrate these were exploitable vectors pre-patch. Since escapeScripts is the primary HTML sanitization function called during page rendering, its lack of these specific sanitization steps directly enabled the vulnerability.
A Semantic Attack on Google Gemini - Read the Latest Research