-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the Go code generator's output formatting logic. The format_go_output function directly concatenated user-controllable file_path into a system command without sanitization. The patch comments out the system() call and adds security warnings, confirming this was the vulnerable path. This function would appear in profilers when generating Go code from Thrift IDL files using vulnerable versions, as it's the entry point for the insecure command execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/apache/thrift | go | <= 0.9.3 | 0.10.0 |