-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gouniverse/cms | go | < 1.4.1 | 1.4.1 |
Miggo AIRoot Cause AnalysisThe core vulnerability exists in PageRenderHtmlByAlias where alias parameter concatenation into HTML responses was observed in pre-patch code (e.g., 'return "Page with alias '" + alias + "' not found"'). The commit 3e661cd fixed this by introducing HTML escaping via hb.NewDiv().Text(alias). FrontendHandlerRenderAsString is included as it directly passes r.URL.Path (user-controlled input) to the vulnerable function. Confidence is high for PageRenderHtmlByAlias due to direct evidence in patch diffs, and medium for FrontendHandlerRenderAsString as it's part of the attack vector but not the primary vulnerable implementation.