-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Zope | pip | >= 5.0.0, < 5.8.6 | 5.8.6 |
| Zope | pip | >= 4.0.0, < 4.8.11 | 4.8.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped use of the title_or_id() method in the Zope Management Interface's breadcrumb generation. The commit diff shows the fix added HTML escaping (html_quote) to this specific template variable in manage_tabs.dtml. Since title_or_id returns user-controllable title property values, its unescaped output in class attributes enables stored XSS payload execution.