-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| discordrb | rubygems | < 3.4.3 | 3.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from constructing shell commands via unsafe string interpolation in encode_file and encode_io methods. The commit diff shows both methods were modified to use an array-based invocation (safe) instead of string interpolation (unsafe). The original implementation in encoder.rb line 80/90 directly interpolated user-controlled parameters into command strings passed to IO.popen, making them vulnerable to command injection. The CVE description and patch commit confirm these were the vulnerable entry points.