-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from environment variable detection expanding to the entire workspace in v15.0.x. The key vulnerable functions were detectVariables() and its helper findTypeScriptFiles(), which together performed unrestricted file scanning. The commit d701f51 replaced findTypeScriptFiles with glob pattern matching and added searchPattern restrictions to detectVariables, confirming these were the problematic functions. The dev-server integration also called detectVariables without restrictions prior to patching.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| angular-server-side-configuration | npm | >= 15.0.0, < 15.1.0 | 15.1.0 |