-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two main issues: 1) Missing authentication in WebSocket/REST handlers (CWE-306) and 2) Path traversal via unvalidated URI-to-path conversion (CWE-22/23). The patch adds auth decorators (@web.authenticated, @authorized) to handlers and implements is_relative path validation. The vulnerable functions were directly handling network endpoints without security checks and processing file paths without containment validation. Test cases like test_shadow_traversal validate the path traversal fix, confirming this was an attack vector.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyter-lsp | pip | <= 2.2.1 | 2.2.2 |
Ongoing coverage of React2Shell