Multiple authoritative sources (GitHub Advisory, NVD, Snyk) explicitly identify the execute function as the injection vector.
The provided PoC demonstrates command injection via root.execute() with untrusted input containing shell operators (&).
CWE-78 classification confirms this is a command injection vulnerability where user input flows directly to OS commands.
While exact implementation details aren't available, the consistent function name across reports and PoC usage provides high confidence in this assessment.
Vulnerable functions
Only Mi**o us*rs **n s** t*is s**tion
WAF Protection Rules
WAF Rule
*ll v*rsions o* p**k*** ****us-*xt-*m*lin* *r* vuln*r**l* to *omm*n* Inj**tion vi* t** *x**ut* *un*tion *u* to improp*r us*r-input s*nitiz*tion.
JavaScript
Miggo AI
