-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| torchserve | pip | >= 0.1.0, < 0.9.0 | 0.9.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from missing path validation in archive extraction functions. The commit diff shows both unzip() and decompressTarGzipFile() were patched with canonical path checks to prevent ZipSlip. The pre-patch code: 1) Used zip/tar entry names directly to create File objects 2) Lacked the canonical path comparison that ensures extracted files remain within the target directory 3) Matches the CWE-22 pattern of improper path limitation. The functions' direct handling of archive entries without validation makes them clearly vulnerable.
Ongoing coverage of React2Shell