-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sidekiq-unique-jobs | rubygems | >= 8.0.0, < 8.0.7 | 8.0.7 |
| sidekiq-unique-jobs | rubygems | < 7.1.33 | 7.1.33 |
Miggo AIRoot Cause AnalysisThe GitHub patch shows critical parameter sanitization changes in lib/sidekiq_unique_jobs/web.rb where all affected parameters (filter, count, cursor, prev_cursor, digest, job_id) were wrapped in h() for HTML escaping. The vulnerability stemmed from these parameters being reflected in the admin UI without proper encoding. The '/changelogs', '/locks', and '/expiring_locks' endpoints were explicitly called out in advisories as XSS vectors via their filter parameters. High confidence comes from direct evidence in commit diffs and CVE descriptions linking unsanitized URL parameters to XSS.