-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simple-git | npm | < 3.16.0 | 3.16.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input sanitization in Git command argument handling. The commit diffs show added validations in block-unsafe-operations-plugin.ts for --upload-pack, --receive-pack, and -u flags, which were previously unsanitized. These methods directly accept user-controllable arguments that get passed to git CLI without proper validation in vulnerable versions. The advisory explicitly names these four methods as attack vectors, and the Snyk PoC demonstrates RCE through these endpoints. The patch adds validation checks specifically for these arguments in the plugin system that these methods utilize.
JavaScriptJavaScriptOngoing coverage of React2Shell