-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| opensearch-ruby | rubygems | >= 2.0.0, < 2.0.2 | 2.0.2 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from the use of YAML.load instead of YAML.safe_load in two locations. The GitHub commit diff explicitly shows these functions being patched. YAML.load is inherently unsafe for untrusted input due to its ability to deserialize arbitrary Ruby objects, which aligns with CWE-502 (Deserialization of Untrusted Data). The linked advisory and supporting references confirm this pattern as the root cause.
Ongoing coverage of React2Shell