-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gogs.io/gogs | go | < 0.12.8 | 0.12.8 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) Initial validation in validateWebhook only checked user admin status rather than consistently validating hostnames, and 2) No revalidation during actual delivery in HookTask.deliver. The commit diff shows critical changes to these functions - removing admin checks in validateWebhook and adding IsBlockedLocalHostname checks in both validation and delivery paths. The ParseRemoteAddr function's migration-related SSRF vector was addressed by upgrading from IsLocalHostname to IsBlockedLocalHostname checks.