-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim-meetings | rubygems | >= 0.28.0, < 0.28.3 | 0.28.3 |
Miggo AIRoot Cause AnalysisThe XSS vulnerability stems from improper handling of URL parameters in meeting embeds. Since the attack vector is a malformed URL, the root cause likely exists in: 1) The controller handling embed requests (EmbedsController#show) that fails to sanitize input before passing to views 2) The view template that renders embed content without proper output encoding. Ruby on Rails ERB templates are particularly vulnerable to XSS when using <%= %> tags without the h/html_escape helper. The workaround suggestion to disable participant-created meetings further indicates the vulnerability exists in the embed rendering flow that processes user-influenced URLs.
A Semantic Attack on Google Gemini - Read the Latest Research