-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.contrib.changerequest:application-changerequest-ui | maven | >= 0.11, < 1.9.2 | 1.9.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped rendering of user-controlled title input in the Change Request UI template. The commit diff shows the fix added $services.rendering.escape() to sanitize the title output. The original code's direct use of $doc.title in a label element (without escaping) allowed script injection. XWiki's template engine executes embedded Groovy code, enabling RCE when malicious content is rendered.
A Semantic Attack on Google Gemini - Read the Latest Research