-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| total4 | npm | < 0.0.81 | 0.0.81 |
Miggo AIRoot Cause AnalysisThe commit diff shows a critical change in internal.js's view_parse function where CONF[config_key] values were previously inserted into the template without proper encoding. The addition of .encode() in the patched version indicates the vulnerability stemmed from missing output encoding when injecting configuration values into the view layer. This aligns with the XSS attack vector described in the CVE, where platform name (a config value) was the injection point.
A Semantic Attack on Google Gemini - Read the Latest Research