-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/apache/incubator-answer | go | < 1.2.5 | 1.2.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper output encoding during web page generation (CWE-79). While exact code isn't available, the pattern matches common XSS flaws in Go web applications: 1) Input handling functions that don't sanitize user-controlled data (summary field), and 2) Template rendering that explicitly trusts stored content by disabling escaping. The combination allows persistent XSS when a malicious summary is rendered without proper encoding. High confidence comes from the CWE classification, vulnerability description, and Go's default security patterns (auto-escaping requires explicit override to be vulnerable).