-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from email template rendering functions that failed to properly sanitize user-controlled input (SSH key names) before placing them in <a> tags. The patch shows critical changes in notification.py where template names were updated to versions that wrap user-controlled variables in non-hyperlink <a> tags (without href attributes), indicating the original templates automatically created hyperlinks. The affected functions access_token_added and user_password_changed directly pass user-controlled 'name' and user object data to these templates, making them the entry points for injection.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rdiffweb | pip | < 2.5.5 | 2.5.5 |