-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cookiecutter | pip | < 2.1.1 | 2.1.1 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from how the 'checkout' parameter is handled in the clone() function. The pre-patch code constructed the hg checkout command as [repo_type, 'checkout', checkout], which didn't sanitize user-controlled input. The fix in the commit adds a '--' separator before the checkout parameter specifically for Mercurial to prevent flag injection. This directly implicates the clone() function in vcs.py as the vulnerable code path where user input was improperly passed to a subprocess call.
Ongoing coverage of React2Shell