-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the code in lgsl_details.php that handles server response data. The original code used html_entity_decode() on the $value variable, which decodes HTML entities and undoes any prior sanitization. This allowed malicious payloads (e.g., injected via the /info endpoint) to execute when rendered. The patch replaced html_entity_decode() with htmlentities(), which properly encodes the output. While the function lgsl_query_40 in lgsl_protocol.php retrieves the data, the actual XSS occurs during rendering in lgsl_details.php, making the processing loop there the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tltneon/lgsl | composer | < 7.0.0 | 7.0.0 |
A Semantic Attack on Google Gemini - Read the Latest Research