-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Red-DiscordBot | pip | <= 3.3.11 | 3.3.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how user-controlled stream names were handled in message templates. The pre-patch code used .format() with {stream} which evaluates Python expressions if malicious format specifiers are present. The commit e269ea0 shows the fix replaced .format() with .replace() for {stream} and {stream.name}, indicating the original formatting approach was vulnerable to code injection via crafted stream names. The check_streams() function was responsible for processing these live alerts, making it the primary vulnerable function.
Access the latest Benchmark Study of WAF Weaknesses and AI Mitigation