-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 3005.4 | 3005.4 |
| salt | pip | >= 3006.0rc1, < 3006.4 | 3006.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from predictable file paths in two key functions: 1) run_ssh_pre_flight used a static path pattern for pre-flight script deployment. 2) shim_cmd used weak randomization for temporary command shims. Both were modified in the CVE fix commit (7a14112) to use proper temporary file handling with unpredictable names. The commit diff shows these functions were directly modified to address path predictability and SCP error checking, aligning with the CVE description.