-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | >= 6.1.0, < 6.1.7.8 | 6.1.7.8 |
| actionpack | rubygems | >= 7.0.0, < 7.0.8.4 | 7.0.8.4 |
| actionpack | rubygems | >= 7.1.0, < 7.1.3.4 | 7.1.3.4 |
| actionpack | rubygems | = 7.2.0.beta1 | 7.2.0.beta2 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stemmed from conditional logic that only applied security headers to HTML responses. The commit shows removal of: 1) The html_response? check in Middleware#call that acted as a guard clause, and 2) The html_response? method itself. These functions together created the vulnerability by restricting header application based on Content-Type. The test case modification from 'non-html requests will not set a policy' to 'will set a policy' confirms this was the vulnerable code path.
Ongoing coverage of React2Shell