-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pillow | pip | < 2.3.1 | 2.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly lists these four functions as problematic. The GitHub commit diff confirms they were modified to replace insecure tempfile.mktemp() usage with secure tempfile.mkstemp() patterns. CWE-59 (Link Following) directly maps to the symlink attack vector enabled by mktemp's predictable temporary filenames. The Debian bug report and NVD/CVE analysis corroborate these functions as the attack surface. High confidence stems from explicit patch evidence and CVE/GHSA documentation.
Ongoing coverage of React2Shell