-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| payload | npm | < 1.7.0 | 1.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in query construction. The release notes for v1.7.0 specifically mention refactoring buildQuery to rely on fields instead of mongoose (commit d187b80), indicating this was the core of the fix. The workaround suggestion to modify 'beforeOperation' hooks to filter 'where' queries further supports that the query builder (buildQuery) was the vulnerable component. The function's role in processing query parameters aligns with the described attack vector of brute-forcing hidden fields through where clauses.
Ongoing coverage of React2Shell