-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | >= 3.11.7, < 3.11.9 | 3.11.9 |
| django-cms | pip | >= 4.1.2, < 4.1.4 | 4.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the handling of the 'page_title' attribute in the templatetag. The commit diff shows removal of a special case for 'page_title' that used strip_tags() and replacement with escape() for all non-datetime attributes. The original implementation only stripped HTML tags but didn't escape special characters, while the fix uses proper HTML escaping. The accompanying test changes verify this by checking escaped XSS payloads instead of just stripped tags.
A Semantic Attack on Google Gemini - Read the Latest Research