-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from sbt's IO.unzip method and its internal extract() function handling ZIP entries without proper path validation. The provided commit diff shows the fix added path normalization checks in extract(), and vulnerability reports explicitly mention IO.unzip as the entry point. Both functions were directly processing ZIP entries using new File(toDirectory, name) without guarding against path traversal, making them the core vulnerable components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.scala-sbt:sbt | maven | >= 0.3.4, < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_2.12 | maven | >= 1.0.0, < 1.9.7 | 1.9.7 |
| org.scala-sbt:io_2.13 |
| maven |
| >= 1.0.0, < 1.9.7 |
| 1.9.7 |
| org.scala-sbt:io_3 | maven | >= 1.0.0, < 1.9.7 | 1.9.7 |
Ongoing coverage of React2Shell