-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around the exposed /api/v1/utils/code/format endpoint. The formatPythonCode function in index.ts directly implements this endpoint's handler without authentication checks (no Authorization header) and accepts arbitrary-sized code payloads. The code shows a direct POST handler that would process large inputs without constraints, matching the described attack vector. Other utility functions in the same file either require authentication (e.g., downloadDatabase) or handle different types of requests.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | ||
| open-webui | npm |
Ongoing coverage of React2Shell