-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stemmed from debug logging that exposed raw Slack webhook URLs. The critical code is in connector.rs where HTTP requests are logged. Pre-patch versions (<1.3.2) contained a direct log statement using request.uri() without redaction for sensitive URLs. The commit diff shows the fix replaced request.uri() with a redacted uri_str in the debug log, and added hashing for sensitive URLs. This function handles request sending and logging, making it the clear source of exposure when handling webhook URLs marked as sensitive.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| slack-morphism | rust | < 1.3.2 | 1.3.2 |
Ongoing coverage of React2Shell