-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paddlepaddle | pip | < 2.4 | 2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the pre-patch implementation of get_window() that directly evaluated user-supplied 'winstr' via eval('_' + winstr). This pattern allowed execution of arbitrary Python code. The commit 26c419c explicitly replaced the dangerous eval() call with a registry lookup (window_function_register.get()), confirming the original eval() usage was the root cause. No other functions show direct user input evaluation patterns in the provided diff.