-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/txthinking/brook | go | < 20230606 | 20230606 |
Miggo AIRoot Cause AnalysisThe core vulnerability exists in the /start handler where user-controlled 'args' parameter was directly concatenated into a shell command without sanitization. The pre-patch code showed:
cmd = exec.Command("/bin/sh", "-c", s+" tproxy "+r.FormValue("args"))
This allows arbitrary command injection via shell metacharacters. The patch added password authentication but didn't fundamentally change the command construction pattern, indicating the vulnerability existed in this function's command assembly logic.
Ongoing coverage of React2Shell