-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mercurial | pip | < 3.8 | 3.8 |
Miggo AIRoot Cause AnalysisThe security patch modifies the init method of the convert_git class in hgext/convert/git.py to explicitly convert paths to absolute paths. This change addresses the core vulnerability where relative paths could be interpreted as Git URL formats (like 'ext::' protocol handlers), enabling command injection. The test cases demonstrate protection against repository names starting with 'ext::' which could execute shell commands. The vulnerable function is the entry point for git repository conversion handling.
PythonPythonOngoing coverage of React2Shell