-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mei2volpiano | pip | <= 0.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using Python's xml.etree.ElementTree library to parse untrusted XML input. The get_mei_elements function directly uses ET.parse(filename) without configuring the XML parser to disable external entity resolution. The Python documentation explicitly states that xml.etree is unsafe for parsing untrusted data due to XXE risks. The function's implementation matches the vulnerability description's root cause (unsafe XML parsing), and the code location is confirmed in the provided GitHub commit diff.
Ongoing coverage of React2Shell