-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| comrak | rust | < 0.17.0 | 0.17.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from AST nodes storing unvalidated byte arrays (Vec<u8>) that were assumed to be valid UTF-8. The HTML formatter functions directly processed these raw bytes without validation. Key functions in html.rs (format_text, format_code, etc.) were modified in the patch to use String fields' .as_bytes() instead of raw Vec<u8>, indicating they previously handled unvalidated bytes. These functions would crash or misbehave when given non-UTF-8 data through manually constructed ASTs, which is exactly the attack vector described in GHSL-2023-049.
RustRustOngoing coverage of React2Shell