-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper path handling in the local development server's asset serving logic. The commit diff shows critical changes in assets.ts where: 1) directory paths are resolved to absolute paths, and 2) a security check was added to ensure resolved file paths start with the build directory. The vulnerable version lacked these protections, allowing attackers to escape the restricted directory via crafted paths. The findAssetEntryForPath() function was directly responsible for mapping URLs to filesystem paths without proper containment checks prior to the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wrangler | npm | < 2.20.1 | 2.20.1 |