-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| h2o | pip | ||
| ai.h2o:h2o-ext-xgboost | maven |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the XGBoostLibExtractTool's main method being exposed through the run_tool command. The code shows it takes a user-controlled directory parameter, performs no security checks on the path, and writes files to it. This allows arbitrary file write attacks. The server shutdown capability is inherent in the tool's execution context. The provided source code confirms the lack of path validation and file write mechanism.
A Semantic Attack on Google Gemini - Read the Latest Research