-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from: 1) Unsanitized time range inputs in dashboard.js being rendered without encoding (fixed by adding htmlStriped). 2) Template name parameters in view functions lacking input validation (fixed by adding str_param checks). The commit adds HTML encoding, input validation patterns (/^\d+$/), and restricted symbol checks - all classic XSS countermeasures. The test cases explicitly validate() against < and > characters in these parameters.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| graphite-web | pip | <= 1.1.10 |
Ongoing coverage of React2Shell