-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/alist-org/alist/v3 | go | < 3.29.0 | 3.29.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the Plist function in helper.go, which handles the /i/:link_name endpoint. The commit diff shows the vulnerability was fixed by adding sanitization (replacing < and > characters) to the Url parameter before including it in the response. The GitHub Security Lab advisory explicitly identifies this function as the source of the reflected XSS, and the CVE description confirms the endpoint's unsafe reflection behavior. The combination of direct user input reflection in an XML context and the lack of initial sanitization matches the XSS vulnerability pattern.