-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kiali/kiali | go | < 1.57.4 | 1.57.4 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stemmed from handling OpenID error parameters in the login page UI. The pre-patch code in LoginPage.tsx directly displayed user-controlled URL parameters ('error', 'error_description', 'openid_error') via the renderMessage function without validation. The GitHub patch shows these specific parameters were moved to console logging with generic error messages displayed instead, confirming the prior direct parameter usage was the vulnerability vector. The renderMessage function and its caller in the render method are the clear points of injection.
Ongoing coverage of React2Shell