-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/moby/buildkit | go | < 0.12.5 | 0.12.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from interactive container APIs accessing worker resources directly rather than through the build job context. Key functions like NewContainer and LLBBridgeToGatewayClient were modified in the patch to stop using worker.Worker.Executor() directly and instead use an executor passed through the build context. This indicates these functions previously lacked entitlement validation by accessing worker resources directly. The gateway frontend initialization was similarly modified to use worker info rather than direct worker access, showing it was part of the insecure path.
GoGoOngoing coverage of React2Shell