-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the template engine's attribute resolution mechanism. The original implementation in get_field didn't validate access to private attributes (those starting with underscore). The fix introduced a 'private_getattr' flag and explicit checks for attribute names starting with '_', preventing access to internal attributes unless explicitly allowed. The commit diff shows this security check was added to the get_field method, and test cases demonstrate exploitation attempts through attributes like init and builtins.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nonebot2 | pip | >= 2.0.0a16, <= 2.1.3 | 2.2.0 |
Ongoing coverage of React2Shell