-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vega-functions | npm | < 5.13.1 | 5.13.1 |
| vega | npm | < 5.23.0 | 5.23.0 |
Miggo AIRoot Cause AnalysisThe vulnerability chain involves two key functions: 1) The scale function (vega-functions/src/functions/scale.js) accepts user-controlled input that flows into getScale. 2) getScale (vega-functions/src/scales.js) retrieves values from a context object that can be manipulated to contain dangerous function references. Together, they enable context.scales[name].value to be set to attacker-controlled functions like [].constructor.constructor, which bypasses Vega's expression sandbox. The PoC demonstrates this by chaining scale calls to execute alert(1), confirming the exploit path through these functions.
A Semantic Attack on Google Gemini - Read the Latest Research