-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pip | pip | >= 1.3, < 6.0 | 6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from pip using predictable build directory paths. The _get_build_prefix function in locations.py generated a non-random path format (e.g., /tmp/pip-build-<username>), which was then set as the default for the build_dir option in cmdoptions.py. This allowed local users to pre-create these directories and block installations. The fix introduced randomized directories via tempfile.mkdtemp, removing reliance on static paths. The commit diff shows removal of build_prefix usage in cmdoptions.py and the introduction of BuildDirectory in install.py/wheel.py, confirming these components were central to the vulnerability.
PythonPythonOngoing coverage of React2Shell