-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langchain | pip | < 0.1.0 | 0.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from how URL validation was performed in extract_sub_links. The pre-patch code only checked if the path started with the base URL string, without proper domain validation. The fix in commit bf0b3cc added proper URL parsing and comparison of network locations (parsed_base_url.netloc != parsed_path.netloc), which correctly prevents cross-domain requests. The function is directly referenced in the vulnerability description and was the focus of the security patch.
Ongoing coverage of React2Shell