-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| crypto-js | npm | < 3.2.1 | 3.2.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerable secureRandom function was generating random numbers by creating a string '0.' + 3-byte integer and converting to float. This method limits entropy to 24 bits (3 bytes) and creates predictable float patterns. The patch replaced it with cryptoSecureRandomInt using 4-byte integers directly. The CWE-330/331 mapping confirms insufficient randomness/entropy, and the vulnerability description explicitly references this insecure concatenation pattern.
Ongoing coverage of React2Shell