-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | < 1.18.1 | 1.18.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing sandbox checks for 1) direct field access and 2) array get/set operations. The commit adds explicit overrides for onGetAttribute/onSetAttribute (field access) and onGetArray/onSetArray (array operations) with security checks. The presence of a TODO comment in the original code ('consider whether it is useful to override onGet/SetArray/Attribute') confirms these security-critical methods were previously unimplemented. The test cases added in SandboxInterceptorTest.java specifically validate() that direct field access (@prop5 syntax) is now properly trapped, demonstrating these were the vulnerable entry points.
A Semantic Attack on Google Gemini - Read the Latest Research