-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nautobot | pip | >= 2.0.0, < 2.1.2 | 2.1.2 |
| nautobot | pip | < 1.6.10 | 1.6.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the Markdown rendering pipeline. The key function render_markdown() in both current (core/) and legacy (utilities/) paths used Django's strip_tags and a regex-based link sanitizer, which failed to properly neutralize XSS vectors. The fix replaced this with nh3-based HTML sanitization. The commit diffs show these functions were modified to add proper sanitization, confirming they were the vulnerable points. The CVE description explicitly mentions inadequate input sanitization in Markdown-rendered fields, which maps directly to these rendering functions.