-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | maven | <= 1.69 | 1.70 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete AST annotation validation during script compilation. The commit diff shows critical additions to RejectASTTransformsCustomizer where super.visitImports() and super.visitAnnotations() calls were added to ensure proper traversal of nested AST nodes. This indicates the original implementation failed to: 1) Check for AST transforms in import statements (e.g., '@Grab' in 'import @Grab com.example'), and 2) Validate annotations nested within other annotations. The test cases added in SandboxInterceptorTest.java specifically target these scenarios, confirming these were the vulnerable pathways.
Ongoing coverage of React2Shell