-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the decodeFolderFilter method in PortalFolder.py, which was publicly exposed via @security.public and used marshal.loads on unvalidated base64-decoded input. The advisory explicitly identifies this method, and the patch replaced marshal with JSON parsing while adding input length checks. The commit diff confirms the removal of insecure deserialization patterns in this function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Products.CMFCore | pip | >= 3.0, < 3.2 | 3.2 |
| Products.CMFCore | pip | < 2.7.1 | 2.7.1 |
A Semantic Attack on Google Gemini - Read the Latest Research