-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow-providers-apache-hive | pip | < 5.0.0 | 5.0.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from how 'hive_cli_params' were handled before being passed to Hive CLI commands. The fix in PR #28101 moved these parameters from connection configuration (user-managed) to hook parameters (code-managed), indicating the original implementation in HiveCliHook.run_cli used unsanitized user input from connections to build OS commands. This matches the CWE-77 pattern of command injection via untrusted input in command execution contexts.
Ongoing coverage of React2Shell