-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the validate_url function. The pre-patch code would check if the input URL existed as a local file and read its contents, even when the user intended to process a web URL. This allowed web URLs containing paths matching local files to trigger file reads. The commit diff shows the vulnerable pattern was replaced with a safer _try_read helper that only attempts file reads after explicit validation, confirming validate_url was the entry point for the flawed logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mangadex-downloader | pip | >= 1.3.0, < 1.7.2 | 1.7.2 |
Ongoing coverage of React2Shell