-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.11.1 | 2.11.1 |
| tensorflow-cpu | pip | < 2.11.1 | 2.11.1 |
| tensorflow-gpu | pip | < 2.11.1 | 2.11.1 |
Miggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was fixed by adding validation for positive lengths in TensorListSplitOp. Though the user-facing API was RandomShuffle, the underlying XLA implementation path for tensor list handling (specifically TensorListSplitOp) was the root cause. The test case demonstrates how invalid parameters could trigger this code path, and the patch adds explicit checks to prevent zero/negative lengths.
Ongoing coverage of React2Shell