-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped filename parameter in the placeholder method. The commit diff shows the fix adds ERB::Util.html_escape_once to sanitize the filename. This function constructs error messages displayed in HTML comments, and prior to patching, user-controlled input (filename) was directly embedded without sanitization, enabling XSS when the SVG file wasn't found. The added spec test explicitly verifies escaping of malicious input in this context.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| inline_svg | rubygems | < 1.7.2 | 1.7.2 |
Ongoing coverage of React2Shell