-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability manifests in regex processing during YAML parsing. Key evidence comes from:
ScannerImpl.scanTag() is primary suspect as it handles tag parsing (like '!!str') where malicious tags would be processed. Resolver.resolve() is secondary vector as type detection uses regex patterns. Both would appear in stack traces during exploitation when processing malicious YAML content.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yaml:snakeyaml | maven | < 1.31 | 1.31 |
Ongoing coverage of React2Shell