-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | >= 5.2.0, < 7.0.8.7 | 7.0.8.7 |
| actionpack | rubygems | >= 7.1.0, < 7.1.5.1 | 7.1.5.1 |
| actionpack | rubygems | >= 7.2.0, < 7.2.2.1 | 7.2.2.1 |
| actionpack | rubygems | >= 8.0.0, < 8.0.0.1 | 8.0.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation when constructing CSP directives. The commit diff shows the fix added a validate() method to check for semicolons and whitespace, which were previously not sanitized. The vulnerable build_directive function (pre-patch) processed user-controlled input without these validations, making directive injection possible. The addition of directive validation in build_directive and associated test cases confirms this was the attack vector.
Ongoing coverage of React2Shell