-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| graphite-web | pip | <= 1.1.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two main patterns: 1) In dashboard.js, user-controlled time range inputs were stored in cookies and used in UI without proper encoding. 2) Multiple view functions in views.py accepted parameters like 'name' and 'key' without adequate validation. The patch adds HTML encoding (htmlStriped/htmlEscape) and input validation (str_param) to these entry points. The test cases specifically validate() XSS prevention in template name/key parameters, confirming these were attack vectors. The CWE-79 classification and commit message about preventing XSS in dashboard queries further corroborate these functions as vulnerable points.