-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionview | rubygems | >= 5.1.0, < 6.1.7.3 | 6.1.7.3 |
| actionview | rubygems | >= 7.0.0, < 7.0.4.3 | 7.0.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from rails-ujs processing data-* attributes (data-method, data-remote, data-disable-with) on elements within a contenteditable context. The commit patches show these functions were modified to add isContentEditable checks, indicating they previously executed their logic without validating() whether the element was editable. This allowed maliciously pasted HTML with these attributes to trigger unintended behavior (e.g., CSRF-like actions via data-method, arbitrary AJAX via data-remote). The absence of contenteditable checks in these handlers directly enabled the DOM-XSS vector.
A Semantic Attack on Google Gemini - Read the Latest Research