-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| publify_core | rubygems | < 9.2.8 | 9.2.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper HTML sanitization in comment processing. The patch adds an allowed_tags list that explicitly removes 'img' tags and modifies the sanitize call in html_postprocess to use this restricted list. The pre-patch version lacked this restriction, making the sanitize call vulnerable to code injection via image tags. The added test case in comment_spec.rb verifies that images are stripped while basic formatting remains, confirming the attack vector was through un-sanitized image tags in user comments.