-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/schollz/croc/v9 | go | < 9.6.16 | 9.6.16 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stemmed from using partial shared secret fragments (first 3-5 characters) to construct room names passed to relays. The patch replaced these with hashed values (c.Options.RoomName). The identified functions directly handled the insecure secret slicing/usage as shown in the diff: croc.go lines 591, 679, 876, and 1300-1304 in the original code used SharedSecret substrings, while the patched version uses the hashed RoomName.
Ongoing coverage of React2Shell