-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| crmsh | pip | <= 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs in the session creation functionality where user-controlled input (session name) is passed to a shell command without proper sanitization. The code at line 476 of history.py uses utils.pipe_cmd_nosudo() with a formatted string containing session_dir, which could contain malicious shell characters. The provided patch from SUSE Bugzilla shows this was fixed by replacing the system mkdir call with Python's Path.mkdir(), confirming the insecure usage of shell commands with user input.
Ongoing coverage of React2Shell