-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/arduino/arduino-create-agent | go | < 1.3.3 | 1.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing signature verification in the tool installation endpoint handler. The fix commit explicitly adds signature verification to the V2 tool install endpoint, indicating the handler function for this endpoint was previously vulnerable. The CWE-345 classification and privilege escalation impact align with unauthenticated package installation capabilities in this endpoint handler.