-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nadesiko3 | npm | < 3.3.75 | 3.3.75 |
Miggo AIRoot Cause AnalysisThe vulnerability chain requires two components: 1) Command injection via file parameter (CWE-78) evidenced by the PoC using backtick-enclosed commands in filenames, fixed in commit adf260d. 2) Weak appkey security that enabled attackers to obtain required authentication tokens, as described in GHSA-7249-8x22-4rg4 and issue #1347. The file parameter handler directly uses user input in system commands without proper sanitization, while the appkey validation didn't prevent brute-forcing.