-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | < 2.6.3 | 2.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using Python's standard regex engine (re module) to process potentially malicious user input in the partial_subset method. The GitHub patch shows this function was modified to use re2 instead of re, specifically when matching task IDs against regular expressions. The CWE-1333 (Inefficient Regex Complexity) directly maps to this pattern matching operation, and the commit message explicitly states the change was made to handle 'untrusted regex'. The function's parameter accepts regex patterns, making it the entry point for crafted malicious input.