-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sccache | rust | < 0.4.0 | 0.4.0 |
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems from the client sending its environment variables (including LD_PRELOAD) to the server during compilation requests. The code in src/commands.rs lines 371-376 explicitly includes env_vars in the Compile request struct. A FIXME comment in src/cmdline.rs:279 acknowledges the risk of not sanitizing LD_PRELOAD. The server's execution environment inherits these variables, enabling privilege escalation when running as root. The function responsible for constructing and sending these tainted environment variables is the root cause.
Ongoing coverage of React2Shell