-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| it.geosolutions.jaiext.jiffle:jt-jiffle | maven | < 1.1.22 | 1.1.22 |
| it.geosolutions.jaiext.jiffle:jt-jiffle-language | maven | < 1.1.22 | 1.1.22 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The Jiffle class's runtime compilation process (createRuntimeInstance) directly incorporated unvalidated user input into generated Java code. 2) The Script class accepted invalid identifiers that could be leveraged for code injection. The patch adds validation (VALID_IDENTIFIER regex) in Script's constructor and proper comment escaping, confirming these were the injection vectors. The commit message specifically mentions validating input variable names and escaping Javadocs, which aligns with these function changes.
Ongoing coverage of React2Shell