-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from rendering user-controlled fields (display_name, question_text, explanations, feedback messages, zone titles) without proper HTML sanitization. The patch introduced the 'sanitize_html' function and applied it to these fields, confirming they were previously vulnerable. The JavaScript changes escaping in the Studio editor further validate XSS vectors in zone previews. The commit diff explicitly shows these functions were modified to add sanitization, indicating high confidence in their role in the vulnerability.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xblock-drag-and-drop-v2 | pip | < 3.0.0 | 3.0.0 |
KEV Misses 88% of Exploited CVEs- Get the report