-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ecdh | npm | < 0.2.0 | 0.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing curve validation in the shared secret derivation process. The pre-patch code in index.js only checked for the existence of publicKey.Q (line 165) but didn't verify the point's validity on the curve. The fix introduced an 'onCurve' validation check within deriveSharedSecret, confirming this was the missing security control. The CVE description and associated issue #3 explicitly reference this attack vector through invalid points, directly implicating the deriveSharedSecret function as the vulnerable entry point.
Ongoing coverage of React2Shell