-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuclide | npm | < 0.290.0 | 0.290.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the hhvm-attach deep link handler in main.js where hostname validation was missing. The commit diff shows the addition of a regex check ([^A-Za-z0-9-._]) to validate hostnames, which was absent in vulnerable versions. The affected code path involves retrieving the hostname via nuclideUri.getHostname() and immediately using it for remote URI construction without validation, making this handler the clear injection point.