-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fileutils | rubygems | < 0.7.1 | 0.7.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of user input passed to shell commands. The commit diff shows critical changes where shell-based implementations (like ln -s) were replaced with Ruby-native methods (File.symlink). Functions like ln_s, install, and cp were modified to eliminate shell command generation, indicating they previously exposed command injection vectors. The advisory confirms URL/shell injection patterns, aligning with these functions' pre-patch behavior of passing user input to shell commands.