-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled alias resolution in YAML parsing. The commit diff shows critical counters (decodeCount, aliasCount, aliasDepth) were added to unmarshal() and alias() functions to prevent abuse. The vulnerable versions lacked these checks, allowing: 1) Decoder.Decode to process malicious documents through public API, 2) unmarshal() to recursively resolve nodes without tracking, and 3) alias() to chase references indefinitely. The GHSA/CVE specifically implicates these core parsing functions when handling aliases.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gopkg.in/yaml.v2 | go | < 2.2.3 | 2.2.3 |
| github.com/go-yaml/yaml | go | <= 2.1.0 |
Ongoing coverage of React2Shell