-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/destinygg/chat | go | <= 0.0.0-20220628124252-0981d5add8f3 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the removed 'CheckOrigin: func(r *http.Request) bool { return true }' line in websocket.Upgrader configuration. This custom implementation disabled security checks by automatically approving all origin headers. The patch removed this override, restoring the library's default origin validation. The combination of CWE-352 (CSRF) and CWE-863 (Incorrect Authorization) aligns with this finding, as improper origin validation allows unauthorized WebSocket connections.
Ongoing coverage of React2Shell