-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues in extractor.py: 1) The callback function processed extracted files/directories without sanitizing symlinks (added in patch via symlink_sanitizer). 2) add_pending function's pre-patch logic (line 190 in diff) allowed recursive processing without validating symlink targets. The patch added: a) symlink sanitization checks, b) --preserve-symlinks opt-out, c) privilege dropping. These functions directly handled archive extraction flow without security checks present in patched versions.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| binwalk | pip | < 2.3.3 | 2.3.3 |
Ongoing coverage of React2Shell