-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| neutron | pip | < 16.4.1 | 16.4.1 |
| neutron | pip | >= 17.0.0, < 17.2.1 | 17.2.1 |
| neutron | pip | >= 18.0.0, < 18.1.1 | 18.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input sanitization in the _format_option function. The commit diff shows the function was modified to split values at the first newline (v.split('\n',1)[0]), indicating it previously concatenated untrusted 'args' parameters without sanitization. The added test case with 'malicious-option' containing newlines demonstrates how unpatched versions would pass multi-line values to dnsmasq. This function is directly responsible for constructing dnsmasq configuration lines from user-controlled extra_dhcp_opts values.
Ongoing coverage of React2Shell