-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Nuitka | pip | <= 0.8.4 | 0.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from multiple instances where eval() was used to process untrusted input (environment variables, file contents, XML data). The GitHub patch shows systematic replacement of eval() with ast.literal_eval(), which safely evaluates literal structures instead of executing arbitrary code. Each identified function directly used eval() on external inputs that could be controlled by an attacker, making them clear injection points. The high confidence comes from: 1) Official patch directly addressing these functions 2) CWE-77/94 alignment with eval() misuse patterns 3) Environment variables and external data being common attack vectors for injection.
Ongoing coverage of React2Shell