-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe handling of GitHub context variables in workflow 'run' commands. The removed 'echo github context' steps in multiple workflow files (visible in the commit diff) demonstrated direct interpolation of untrusted inputs (github.context values) into shell commands. This pattern matches classic command injection where attacker-controlled values flow into command execution contexts without proper sanitization. The patch addressed this by removing these unsafe echo commands and implementing environment variable-based handling of untrusted data.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gradio | pip | < 4.18.0 | 4.18.0 |
Ongoing coverage of React2Shell