-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization during account synchronization in the privileged $SYS account. The advisory explicitly mentions 'inadequate check in constructing filenames for account synchronization' leading to directory traversal. While exact function names aren't provided in available resources, NATS's architecture requires account data persistence, and the described vulnerability pattern strongly suggests a file path construction function in account management logic that fails to validate user-controlled path components. The confidence is high because the CWE-22 classification and advisory details directly point to this class of vulnerability in account synchronization handlers.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/nats-io/nats-server | go | >= 2.2.0, < 2.7.4 | 2.7.4 |
Ongoing coverage of React2Shell