-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe critical vulnerability stems from improper Origin header validation in the set_headers function. The commit diff shows the validation was changed from a prefix check (startswith) to an exact match comparison. The original implementation's use of startswith() allowed malicious origins with matching prefixes (e.g., 'http://victim.com.attacker.net' matching 'http://victim.com'). The added test case 'test_post_with_prefixed_origin' demonstrates this vulnerability by showing prefixed origins were previously accepted. The CWE-346 classification and CVSS 9.8 score confirm the critical nature of this origin validation flaw in the identified function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rdiffweb | pip | < 2.5.0a5 | 2.5.0a5 |
PythonPythonOngoing coverage of React2Shell