-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| de.taimos:pipeline-aws | maven | < 1.41 | 1.41 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure YAML deserialization. While exact code isn't provided, the advisory explicitly states the parser wasn't configured to prevent arbitrary type instantiation. This strongly suggests usage of an unsafe YAML loading method like SnakeYAML's Yaml.load() without a SafeConstructor. The fix in v1.41 would involve implementing type filtering, which aligns with common YAML deserialization vulnerability patterns (CWE-502). The high confidence comes from the direct match between described vulnerability behavior and known unsafe YAML parsing practices.
KEV Misses 88% of Exploited CVEs- Get the report