-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langchain-experimental | pip | <= 0.0.14 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from the incomplete blocklist in COMMAND_EXECUTION_FUNCTIONS, which failed to include 'import'. This oversight allowed attackers to use 'import' in Python code executed via PALChain, bypassing the CVE-2023-36258 fix. The GitHub commit explicitly adds 'import' to this list to mitigate the issue, confirming its role in the vulnerability. The list is central to the validation logic in pal_chain/base.py, and its prior incompleteness directly enabled arbitrary code execution.
Ongoing coverage of React2Shell