-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dulwich | pip | < 0.9.9 | 0.9.9 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from build_index_from_tree's lack of path validation before the patch. The commit diff shows the addition of a 'validate_path' parameter (defaulting to a .git/ checker) and a skip condition in the entry processing loop. Pre-patch versions would write any tree entry to disk, including dangerous .git/ paths. The CVE description explicitly names this function, and the fix directly modifies its logic to add validation.
Ongoing coverage of React2Shell