-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 9.16.0 | 9.16.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) Filter processing logic allowing string operators on hashed fields, and 2) GraphQL type definitions not properly restricting operators for concealed fields. The patches in PR#14829 and PR#15010 explicitly address these by introducing operator allow-list checks and specialized GraphQLHash types. While exact function names aren't visible in diffs, the pattern matches Directus' architecture where items service handles filtering and GraphQL types define field capabilities. The combination of these two components being improperly configured would directly enable the described hash extraction attack.
Ongoing coverage of React2Shell