-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 12.0.0 | 12.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how path canonicalization was performed in _join_and_check_path_within_fs. The original implementation used os.path.realpath(), which runs with the Nova user's permissions and cannot resolve symlinks in directories only readable by root. The patch replaced this with a root-privileged readlink -nm call, confirming the function's role in the vulnerability. The commit message explicitly states this was a refinement to prevent symlink attacks in root-only accessible paths, and the CWE-863 (Incorrect Authorization) classification aligns with the missing privilege escalation during path resolution.
Ongoing coverage of React2Shell