-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snyk | npm | < 1.996.0 | 1.996.0 |
| snyk-go-plugin | npm | < 1.19.1 | 1.19.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how snyk-go-plugin processed the 'ignore' field in vendor.json. User-supplied values were passed to child_process.spawn() with shell mode enabled, as evidenced by the patch message 'disable 'shell' for child processes.' The Imperva blog confirms the exploit involved injecting shell metacharacters into this field, which were executed due to improper neutralization. While exact function names/paths aren't explicitly provided in available sources, the CWE-78 pattern and patch context strongly indicate the command execution function in the Go plugin's dependency analysis logic was vulnerable.
Ongoing coverage of React2Shell