-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped HTML insertion in the key_value field rendering. The commit diff shows the fix added DOMPurify sanitization to the key/value parameters passed to interpolatedRow. Before the patch, the function directly used raw user input to build HTML via string interpolation (lines 38-49 in key_value_component.html.erb references), which were then injected into DOM via innerHTML in the controller. The JavaScript controller's row generation was the injection point rather than the ERB templates themselves, as the XSS execution context is client-side DOM manipulation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| avo | rubygems | >= 3.0.0.beta1, <= 3.2.3 | 3.2.4 |
| avo | rubygems | <= 2.46.0 | 2.47.0 |
Ongoing coverage of React2Shell