-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from improper array index handling in the GraphQL data builder. The commit diff shows the vulnerable version used 'field[splited_path.last.to_i] = wrapped_file' without validation. The patched version adds strict index validation (verify_array_index!) and integer parsing (parse_array_index) to prevent out-of-bounds writes. The HackerOne report demonstrates how crafted 'map' parameters with large indices could force the server to generate massive error responses, confirming this function's role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apollo_upload_server | rubygems | < 2.1.0 | 2.1.0 |
Ongoing coverage of React2Shell