-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pay | rubygems | < 6.3.2 | 6.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key points: 1) The controller's show action accepted and propagated the 'back' parameter without proper path validation (allowing arbitrary URIs), and 2) The view template rendered this parameter in a link_to helper without HTML sanitization. The commit patches explicitly address both: by using URI.parse to restrict to relative paths in the controller and adding sanitize in the view. The pre-patch code for these components directly used user input in unsafe contexts.
Ongoing coverage of React2Shell