-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yiisoft/yii2-gii | composer | < 2.2.2 | 2.2.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the validateMessageCategory method. The commit diff shows the fix added a regex pattern (\w+) to restrict messageCategory values, proving the original implementation lacked proper sanitization. Attackers could exploit this by supplying a crafted messageCategory containing PHP code termination characters (like ') followed by malicious code, which would then be embedded in generated model files. The validateMessageCategory() function was the primary validation gatekeeper for this input, making it the root vulnerable function.
Ongoing coverage of React2Shell