-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.webjars.npm:jsonpath-plus | maven | <= 6.0.1 | |
| jsonpath-plus | npm | < 10.2.0 | 10.2.0 |
Miggo AIRoot Cause AnalysisThe core vulnerability stemmed from JSONPath's _eval function using Node.js' vm module without proper sandboxing. The SafeScript implementation (meant to fix this) initially had insufficient property access controls in evalMemberExpression, allowing bypasses via constructor/prototype properties. The commit diffs show these functions were modified to add security checks like blocking 'constructor' access and using Object.hasOwn for property checks.
A Semantic Attack on Google Gemini - Read the Latest Research