-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/fluid-cloudnative/fluid | go | < 0.9.3 | 0.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from constructing OS commands using user-controlled inputs without proper sanitization. Key indicators: 1) The patch adds security.EscapeBashStr to parameters used in command construction 2) Removes dangerous 'bash -c' patterns 3) Fixes command construction in metrics collection (GetUsedSpace/GetFileCount) and mount command generation (genWorkerMount/genFuseMount). These functions handled untrusted inputs like mount paths, runtime names, and config values that were directly interpolated into shell commands.
Ongoing coverage of React2Shell