-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| avo | rubygems | >= 3.0.0.beta1, < 3.3.0 | 3.3.0 |
| avo | rubygems | < 2.47.0 | 2.47.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized HTML being rendered in action completion toasts. The patch adds DOMPurify sanitization to the key/value parameters passed to interpolatedRow in the KeyValueController. This indicates that interpolatedRow was previously responsible for rendering raw user-controlled content (from Action's error/succeed methods) into the DOM without sanitization, making it the direct injection point for XSS.
Ongoing coverage of React2Shell