-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim-admin | rubygems | <= 0.27.6 | 0.27.7 |
| decidim-admin | rubygems | >= 0.28.0, <= 0.28.1 | 0.28.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of user-controlled input in admin logs. The critical change in the patch modifies the organization presenter's settings_attributes_mapping to handle 'name' as an i18n field instead of a raw string. This indicates the original implementation failed to properly sanitize translated content when rendering admin activity logs, making it susceptible to XSS through crafted resource names. The direct correlation between the CWE-79 classification and the patched presentation logic confirms this as the vulnerable function.
A Semantic Attack on Google Gemini - Read the Latest Research