-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| semver-tags | npm | <= 0.4.10 |
Miggo AIRoot Cause AnalysisThe vulnerability is clearly identified in the getGitTagsRemote function through multiple sources: 1) The GitHub advisory directly references line 21 of get-tags.js which contains the vulnerable command construction. 2) The code shows direct interpolation of the path parameter into a shell command without proper escaping (cp.exec('git ls-remote --tags "' + path + '"')). 3) The Snyk PoC demonstrates exploitation through manipulated path input. 4) CWE-77 classification confirms command injection pattern. Other functions like getGitTags and getSvnTags don't show the same unsanitized input pattern in the provided code snippets.
Ongoing coverage of React2Shell