-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| undici | npm | >= 4.8.2, <= 5.5.0 | 5.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from ProxyAgent's failure to implement certificate validation during TLS handshakes with the target server when using a proxy. The dispatch function orchestrates proxy communication but does not enforce secure TLS parameters. The createConnection function (or equivalent TLS setup logic) likely omits 'rejectUnauthorized' checks and proper SNI configuration, enabling unverified MITM proxying. These functions are core to the agent's proxy handling, aligning with the described MITM behavior and CWE-295.