-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of Tentacles (plugin packages) uploads in the WebInterface. The changelog for 0.4.4 specifically mentions fixing a WebInterface security issue, and multiple sources reference malicious Tentacle uploads as the attack vector. The PYSEC advisory links to an exploit demonstrating RCE through crafted Tentacle packages. The vulnerable function would be responsible for processing uploaded Tentacle packages, which in vulnerable versions lacked proper validation of contained files, allowing execution of arbitrary Python code from the uploaded archives.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| OctoBot | pip | < 0.4.4 | 0.4.4 |