-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glance | pip | < 11.0.0a0 | 11.0.0a0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from incomplete URI scheme validation in validate_external_location(). The commit diff shows the function was modified to add 'filesystem' to RESTRICTED_URI_SCHEMAS and changed validation logic from checking against a filtered list of known schemes to explicitly blocking restricted schemes. The original code's 'valid_schemes' list explicitly excluded 'file' and 'swift+config' but didn't account for 'filesystem' being present in store_api.get_known_schemes(), allowing it through validation. This matches the CVE description about the filesystem:// scheme being improperly permitted.
A Semantic Attack on Google Gemini - Read the Latest Research