-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | >= 0.15.0, <= 0.17.0 | 0.17.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient argument validation in routines handling external authentication and client ACLs. The CVE description explicitly mentions embedding restricted routines within allowed ones, which implies flaws in the permission validation layer. The Salt 0.17.1 release notes reference multiple security patches for argument sanitization in execution modules, particularly focusing on ACL validation and routine execution pathways. The LocalClient.cmd method is core to command execution flow, and PublisherACL.check_acl is directly responsible for ACL enforcement. Both would require argument validation improvements to prevent embedded routine exploitation, as indicated by the CVE description and patch commit messages referencing ACL fixes.
Ongoing coverage of React2Shell