-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sidekiq | rubygems | >= 7.0.4, < 7.0.8 | 7.0.8 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from two Sinatra route handlers in web/application.rb that processed the :period parameter without adequate sanitization. The pre-patch code used raw params[:period] input (vulnerable versions 7.0.4-7.0.7), while the fix in 7.0.8 added both length truncation ((params[:period]||'')[0..1]) and HTML escaping (h() method). This matches the CWE-79 XSS pattern where untrusted input flows directly into HTML output without proper neutralization. The commit diff and CVE description explicitly identify these endpoints as the attack vectors.
Ongoing coverage of React2Shell