-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| global-modules-path | npm | < 3.0.0 | 3.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using execSync with untrusted input without proper sanitization. The commit diff shows replacement of execSync with spawnSync in these functions, specifically addressing command injection vectors. Each function constructs shell commands using user-controlled parameters (pathToNpm, executableName) without validation, allowing attackers to inject arbitrary commands through command concatenation. The patch author's message explicitly states this was the root cause, and the CWE-77 mapping confirms command injection pattern.
Ongoing coverage of React2Shell