-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paddlepaddle | pip | <= 2.6.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability exists in the _convert_to_pdf inner function within IrGraph.draw. The original implementation used subprocess.call() with shell=True and string-concatenated command arguments, making it susceptible to command injection through specially crafted filenames. The patch fixes this by using argument list format and removing shell=True, which is a well-known mitigation for command injection vulnerabilities (CWE-77). The direct correlation between the vulnerability description, CWE classification, and the patched code confirms this function as the vulnerable component.
KEV Misses 88% of Exploited CVEs- Get the report