-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the URL_REGEX pattern used in parse_index_server. The commit diff shows this function was modified to remove regex-based validation, and the advisory explicitly references ReDoS in URL parsing. The removed URL_REGEX in regex.py contained complex patterns with nested quantifiers and lookaheads - a classic ReDoS vector. The function's direct interaction with user-controlled URLs makes it the entry point for exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dparse | pip | < 0.5.2 | 0.5.2 |
Ongoing coverage of React2Shell