-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ubi-reader | pip | < 0.8.5 | 0.8.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how dent_node.name was handled in extract_dents. The pre-patch code joined user-controlled node names (dent_node.name) with the output path without sanitization. The commit diff shows the vulnerability was fixed by adding an is_safe_path check specifically in extract_dents, confirming this was the vulnerable function. The CVE description explicitly cites node name handling as the root cause, and the patch modifies this function's logic to add security checks.
PythonPythonOngoing coverage of React2Shell