-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability manifests in the ParseVector function as shown in the panic trace and commit diff analysis. The pre-patch code split the vector into parts and iterated through metric groups using nested slices (slcs). When processing a full 14-component vector, the loop would increment 'slci' beyond the length of the 'slcs' array (length=3, index=3), causing an out-of-bounds read. The patched commit introduced a fixed 'order' array and added a bounds check ('if slci == 4') to prevent this. The exploit example directly triggers this code path, confirming the function's vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/pandatix/go-cvss | go | >= 0.2.0, < 0.4.0 | 0.4.0 |
Ongoing coverage of React2Shell