-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing XSRF protection in the file handling GET endpoint. The patch adds 'self.check_xsrf_cookie()' to the get method, indicating this security check was previously absent. This function serves /files/ URLs and its lack of XSRF validation directly enables the cross-site inclusion vulnerability by failing to verify request origin authenticity.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyter-server | pip | < 2.7.2 | 2.7.2 |