-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper error handling in the C++ binding layer. The commit diff shows critical error-checking was added around func->Call() in ObjectByteWriterWithPosition::Write, including TryCatch and MaybeLocal checks. This matches the CWE-690 pattern (unchecked return value leading to NULL dereference) and the PoC demonstrating crashes when passing null to PDFStreamForResponse(). The test case added in BasicModificationWithStreams.js specifically validates this fix by checking for proper error throwing instead of crashes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| muhammara | npm | < 2.6.0 | 2.6.0 |
| hummus | npm | >= 1.0.0, <= 1.0.110 | 1.0.111 |
JavaScriptJavaScriptOngoing coverage of React2Shell