-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| conf-cfg-ini | npm | < 1.2.2 | 1.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the decode function's handling of INI parsing. The patch adds validation checks for protected prototype-related keys (proto, defineGetter, etc.) in two critical areas: 1) When creating new sections, and 2) When processing key-value pairs. The vulnerable versions lacked these checks, allowing attackers to use specially crafted section headers or keys to modify the Object prototype. The commit diff clearly shows these security checks were added to the decode function, and the CVE description specifically mentions exploitation through the decode method.
JavaScriptJavaScriptOngoing coverage of React2Shell