-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.json:json | maven | < 20230227 | 20230227 |
| cn.hutool:hutool-json | maven | < 5.8.25 | 5.8.25 |
Miggo AIRoot Cause AnalysisBoth libraries' XML-to-JSON conversion functions (XML.toJSONObject entry points) utilized recursive parsing without stack depth checks. The vulnerability manifests when converting malicious XML with hundreds/thousands of nested elements, as shown in the PoC. The patches (added maxNestingDepth checks in JSONML.java and ParseConfig in Hutool) directly address uncontrolled recursion in these functions, confirming their role in the vulnerability.