-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| weixin-python | pip | < 0.5.5 | 0.5.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in two locations: 1) msg.py's parse method handled incoming XML messages without disabling entity resolution. 2) pay.py's to_dict method processed payment XML data with the same vulnerable pattern. The patch explicitly adds 'resolve_entities=False' to XMLParser in both locations, confirming these were the vulnerable entry points. Both functions directly process external XML input and matched the vulnerability description's reference to 'validate/to_xml' functionality.