-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/answerdev/answer | go | < 1.0.5 | 1.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing input sanitization in the site configuration update flow. The patch added a new Sanitizer validation directive using bluemonday's UGCPolicy to critical fields in SiteGeneralReq. Prior to 1.0.5, the UpdateGeneral controller endpoint accepted and stored these fields (Name, ShortDescription, etc.) without proper HTML escaping, as evidenced by the addition of 'sanitizer' validation tags in the schema and the new Sanitizer function in the validator. The combination of unsanitized storage in siteinfo_controller.go and missing validation rules in siteinfo_schema.go created the XSS vulnerability.
GoGoOngoing coverage of React2Shell