Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) in the GET /api/app-images/logo endpoint, with a related stored XSS vector in the settings. The root cause is the lack of input validation on the color query parameter, which is used to customize an SVG image returned to the user.
The attack flow for the reflected XSS is as follows:
/api/app-images/logo endpoint with a malicious payload in the color parameter (e.g., color=red</style><script>alert('XSS')</script>).(*AppImagesHandler).GetLogo function receives the request and passes the malicious color value to the (*ApplicationImagesService).GetImageWithColor method.applyAccentColorToSVG (renamed to applyAccentColorToSVGInternal in the patch), which uses strings.ReplaceAll to substitute the payload directly into the SVG's <style> block without sanitization.<script> tag into the SVG.Content-Type of image/svg+xml.A similar stored XSS vulnerability existed in (*SettingsService).prepareUpdateValues, which allowed saving a malicious color value to the database.
The patch mitigates these vulnerabilities by introducing a strict regex (settings.SafeAccentColor) to validate the color parameter in both the image rendering and settings update paths, ensuring only safe CSS color values are processed. It also adds the X-Content-Type-Options: nosniff header as a defense-in-depth measure.
(*AppImagesHandler).GetLogobackend/internal/huma/handlers/appimages.go
(*ApplicationImagesService).GetImageWithColorbackend/internal/services/app_images_service.go
(*ApplicationImagesService).applyAccentColorToSVGInternalbackend/internal/services/app_images_service.go
(*SettingsService).prepareUpdateValuesbackend/internal/services/settings_service.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/getarcaneapp/arcane/backend | go | <= 1.18.1 | 1.19.0 |