-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ghost | npm | < 5.46.1 | 5.46.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from unvalidated filter parameters in Content API endpoints. The commit adds 'rejectPrivateFieldsTransformer' to prevent filtering on password/email fields. The original vulnerable functions were direct database query methods (findPage/findOne) in public API endpoints that processed user-supplied 'filter' parameters without sanitization. The patch explicitly modifies these exact functions to include the security transformer, confirming their role in the vulnerability. Test cases added in the commit verify that these endpoints previously allowed filtering by sensitive fields.
A Semantic Attack on Google Gemini - Read the Latest Research