-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing virtual size checks in three key areas: 1) fetch_to_raw in images.py didn't compare disk_size with max_size before the patch, 2) Raw.create_image in imagebackend.py didn't propagate size constraints to fetch operations, and 3) utils.py's fetch_image didn't pass max_size to fetch_to_raw. The commit added max_size parameters and verify_base_size checks to all these code paths, confirming these were the vulnerable points when those validations were absent.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 12.0.0a0 | 12.0.0a0 |
Ongoing coverage of React2Shell