-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| static-web-server | rust | < 2.30.0 | 2.30.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped HTML output in directory listings. The release notes show directory listing handling was refactored in PR #367 using maud templates, which auto-escape by default. This implies previous implementations (vulnerable versions) used unsafe string concatenation. The core functions responsible for rendering directory listings and formatting individual entries would have directly inserted user-controlled file names into HTML without sanitization. The 'current_path' and 'file_name' parameters mentioned in the advisory map directly to values processed by these listing rendering functions.
RustRustOngoing coverage of React2Shell