-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| papercrop | rubygems | < 0.3.0 | 0.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the crop_command method. The pre-patch code (v<0.3.0) directly accessed crop parameters via metaprogramming (target.send) and passed them to ImageMagick's -crop argument without type validation. The critical commit added Integer() conversion and error handling, confirming the vulnerability was in parameter handling within this function. The CWE-20 mapping and critical severity both align with unvalidated input being used in command construction.
Ongoing coverage of React2Shell