-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization handling in LazyList's SerializationProxy. The original implementation (before 2.13.9) used 'tail.prependedAll(init)' during deserialization, which could trigger evaluation of a forged Function0 (lazyState) from the deserialized tail. The GitHub PR #10118 specifically modifies this deserialization path to use 'stateFromIteratorConcatSuffix' instead, preventing immediate Function0 execution. This matches the CVE description of Function0-based gadget chain exploitation during LazyList deserialization.
Ongoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.scala-lang:scala-library | maven | >= 2.13.0, < 2.13.9 | 2.13.9 |