-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The window endpoint in routes.py handles the 'location' parameter without validating the domain (pre-patch), allowing arbitrary URLs. 2) The Request.send method in request.py blindly executes requests with this untrusted input. The commit 3a2e0b2 added domain validation to both endpoints, confirming these were the vulnerable points. The CVE description explicitly references the window endpoint's lack of sanitization and the send method's role in processing the malicious request.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| whoogle-search | pip | >= 0, < 0.8.4 | 0.8.4 |