-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper shell command construction in multiple functions within action_reposync.py. The GitHub patch adds pipes.quote() to user-controlled parameters in these functions, confirming they previously lacked proper input sanitization. All identified functions directly incorporate user-provided repository configuration values (mirror URLs, paths, names) into shell commands without escaping, enabling command injection. The root cause aligns with CWE-20 (Improper Input Validation) as described in the CVE, and the patch's targeted fixes validate() these as the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cobbler | pip | <= 2.8.2 | 3.0.0 |