-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| omero-web | pip | < 5.26.0 | 5.26.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated use of the 'callback' parameter in JSONP endpoints. The commit diff shows the vulnerability was patched by adding a regex check (VALID_JS_VARIABLE) to the 'wrap' function in views.py. This function previously took the callback parameter from request.GET and constructed a JSONP response without validation, making it the clear injection point. The direct modification of this function in the patch confirms its role in the vulnerability.
A Semantic Attack on Google Gemini - Read the Latest Research