-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mapshaper | npm | < 0.6.44 | 0.6.44 |
Miggo AIRoot Cause AnalysisThe key vulnerability was in the web server's URI handling logic. The commit diff shows a critical addition of a 'uri.includes('..')' check in bin/mapshaper-gui, which blocks path traversal attempts. Before this patch, the code would process any URI without sanitization, including those with '../' sequences. The serveFile() function would then attempt to read from unsanitized paths, making the http.createServer callback the primary vulnerable entry point. This matches the CWE-22 (Path Traversal) description and the patch's security-focused changelog entry about blocking external file access attempts.
A Semantic Attack on Google Gemini - Read the Latest Research