-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| http | pub | < 0.13.3 | 0.13.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the lack of validation on the 'method' parameter in the BaseRequest constructor. The patch added a RegExp validation (_tokenRE) to ensure only valid HTTP token characters are allowed. The pre-patch code in base_request.dart directly assigned 'this.method' without sanitization, making it the clear injection vector. The CWE-74 classification and CRLF injection scenario described in advisories directly implicate this constructor as the vulnerable entry point.