-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rdoc | rubygems | >= 6.4.0, < 6.4.1.1 | 6.4.1.1 |
| rdoc | rubygems | >= 6.5.0, < 6.5.1.1 | 6.5.1.1 |
| rdoc | rubygems | >= 6.6.0, < 6.6.3.1 | 6.6.3.1 |
| rdoc | rubygems | >= 6.3.3, < 6.3.4.1 | 6.3.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization using Marshal.load without proper class filtering. The GitHub patch shows multiple instances in store.rb where direct Marshal.load calls were replaced with a filtered version (marshal_load). The original implementations in load_cache, load_class_data, load_method, and load_page all used Marshal.load on untrusted data without restricting deserializable classes, enabling object injection attacks. The patch adds a MarshalFilter that restricts classes to basic types and RDoc:: namespaced objects, confirming these were the vulnerable points.
RubyRubyOngoing coverage of React2Shell