-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.calcite.avatica:avatica-core | maven | < 1.22.0 | 1.22.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the instantiateClient function's pre-patch behavior where it: 1) Used Class.forName() on user-controlled input without interface validation 2) Directly instantiated the class via reflection using getConstructor(URL.class). The patch adds critical asSubclass(AvaticaHttpClient.class) verification and changes exception handling to prevent invalid class instantiation. The function's pre-1.22.0 implementation matches the CWE-665 (Improper Initialization) description by failing to properly validate class constraints before object creation.
Ongoing coverage of React2Shell