-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing origin validation in API request handling. The patch added a check_origin() method and enforced it in prepare(), indicating the original prepare() method lacked CSRF protections. Since APIHandler is the base class for all API endpoints, its prepare() method's lack of origin validation directly enabled CSRF across all vulnerable endpoints. The commit diff explicitly shows these security checks were added post-vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ipython | pip | >= 0.12, < 2.4.1 | 2.4.1 |
| ipython | pip | >= 3.0.0, < 3.2.3 | 3.2.3 |
Ongoing coverage of React2Shell