-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langchain | pip | < 0.0.225 | 0.0.225 |
Miggo AIRoot Cause AnalysisThe critical vulnerability stemmed from the 'other' method's use of exec() with raw user input. The GitHub patch shows this was replaced with a safer JSON-based approach using getattr() to restrict API calls. The pre-patch implementation (CWE-78) directly evaluated user input as Python code, making it susceptible to command injection. The commit message explicitly states this was an RCE vulnerability fixed by removing the exec() pattern.