-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | <= 7.0.4 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key patterns: 1) checkNoMatch's use of innerHTML += noMatchText, which could contain unescaped user input. 2) The dynamic HTML string construction in the search handler that embedded the 'path' parameter without sanitization. The patch addressed both by replacing innerHTML with DOM methods (appendChild/replaceChildren) and using innerText in the new buildTr function, eliminating HTML injection vectors.