-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gin-gonic/gin | go | < 1.6.0 | 1.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using fmt.Sprintf's %s format verb with unsanitized user-controlled input (request path) in defaultLogFormatter. This allowed newline characters in paths to create fake log entries. The commit a71af9c fixed this by switching to %#v which adds Go string escaping. The Logger and LoggerWithFormatter functions propagate this vulnerability as they're entry points for the logging middleware configuration. The test file changes confirm the injection was possible via path manipulation and was mitigated by quoting/escaping.
GoGoOngoing coverage of React2Shell