-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| plone | pip | < 4.2.3 | 4.2.3 |
| Plone | pip | >= 4.3a0, < 4.3b1 | 4.3b1 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly references gtbn.py as the source of the sandbox bypass. While the exact function names aren't disclosed in public advisories, the file's role in Python sandboxing (likely implementing TAL expression evaluation or similar) makes it the logical location for the flaw. The CWE-94 (Code Injection) classification confirms this involves improper control of code generation/execution. The patched versions (4.2.3/4.3b1) and associated hotfix documentation further corroborate that modifications to this file were critical for resolving the issue.
Ongoing coverage of React2Shell