-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
ErlangErlang| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ecto | erlang | = 2.2.0 | 2.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the reverted commit 8e1b378 which modified query_for_get_by to handle nil values with is_nil. The patch diff shows this function was responsible for processing WHERE clauses in get_by queries. By automatically converting {key, nil} tuples to is_nil(field(x, ^key)) without proper validation, it circumvented Ecto's security measures that normally require explicit is_nil usage. This matches the advisory's description of lacking protection mechanisms between is_nil and raise, and the revert commit message explicitly cites security implications for nil handling.
Ongoing coverage of React2Shell