-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mysql2 | npm | < 3.9.3 | 3.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the original implementation of keyFromFields which used manual string concatenation with '/' and ':' separators to create cache keys. This allowed injection of colon characters in field properties (like name, schema, or table) to create ambiguous cache keys. The GitHub patch replaced this with JSON.stringify serialization to safely structure the key. Multiple sources (CVE description, commit message, and security advisories) explicitly reference keyFromFields as the vulnerable component. The attack vector demonstrated in the blog post and Snyk's PoC both rely on manipulating field metadata to exploit this key generation weakness.
JavaScriptJavaScriptOngoing coverage of React2Shell