CVE-2023-26131: Algernon engine and themes vulnerable to Cross-site Scripting
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.45489%
CWE
Published
5/31/2023
Updated
11/4/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/xyproto/algernon | go | <= 1.15.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability documentation explicitly identifies themes.NoPage(filename, theme) as the XSS source. The implementation in themes/html.go line 145 shows unsafe concatenation of the filename parameter into HTML output. The handler in engine/handlers.go line 514 calls this function with unsanitized user input from the request URL path, creating a reflected XSS vulnerability when serving 404 error pages.