-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| liquidjs | npm | < 10.0.0 | 10.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from prototype property exposure when accessing object properties. The key changes in the security patch show:- 1) readProperty was modified to accept an 'ownPropertyOnly' parameter and delegate to readJSProperty- 2) readJSProperty was added with an explicit Object.hasOwnProperty check when 'ownPropertyOnly' is true. The original implementation without these checks would access inherited prototype properties when 'ownPropertyOnly' was false (default). getFromScope's reduction logic propagated this vulnerability through the scope traversal. The tests added in the commit verify that prototype properties are hidden when 'ownPropertyOnly' is enabled, confirming the vulnerable pattern in these functions.
A Semantic Attack on Google Gemini - Read the Latest Research