-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| exotel | pip | = 0.1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from malicious code in setup.py that executes during installation. The PostInstallCommand class overrides the standard install process to call the send() function, which performs network calls to suspicious domains and executes downloaded binaries. This meets all criteria for a code execution backdoor: 1) Triggered during installation (automatic execution), 2) Downloads external payloads, 3) Executes arbitrary code. The Windows-specific payload delivery (os.system('start '+filename)) specifically targets Windows environments. The code is clearly present in the published 0.1.6 version's setup.py as shown in PyPI inspector data.
A Semantic Attack on Google Gemini - Read the Latest Research