-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @kyivstarteam/react-native-sms-user-consent | npm | < 1.1.5 | 1.1.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the registerReceiver function in SmsUserConsentModule.kt registering a receiver without proper permission constraints. The patch adds SmsRetriever.SEND_PERMISSION to registerReceiver's parameters, confirming the vulnerability was caused by missing permission enforcement. CWE-926 directly maps to this unprotected component export scenario. The commit diff and advisory both explicitly reference this function as the attack vector.