-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe key vulnerability stems from the unguarded mask shift operation in the EBML element size calculation loop (CWE-835). The commit 2c4d120 explicitly adds 'mask !== 0' to prevent infinite loops. The readChildren function modification suggests potential secondary issues in recursion control. The MKV parser's element size decoding is the primary attack vector, as confirmed by the added test case and CVE description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| file-type | npm | >= 17.0.0, < 17.1.3 | 17.1.3 |
| file-type | npm | >= 13.0.0, < 16.5.4 | 16.5.4 |