-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe core vulnerability exists in both source and transpiled versions of openInBrowser, which directly interpolates user-controlled URLs into a system command via exec(). The functions lack any input validation or escaping mechanisms (like using execFile with arguments array), making them susceptible to OS command injection when processing malicious search result links. This matches the CWE-78 description of improper neutralization in OS commands.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| google-it | npm | <= 1.6.2 |
KEV Misses 88% of Exploited CVEs- Get the report