-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | <= 10.8.2 | 10.8.3 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from hardcoded version references through the DIRECTUS_VERSION constant, which was injected via Vite's build process. The init function in main.ts used this constant for logging, and navigation.vue used it in UI rendering - both embedding the version in client-side JS bundles. The commit patched this by removing these direct references and moving version fetching to authenticated API calls in server.ts. These functions were clearly identified as vulnerable through their direct use of the build-injected constant that exposed version information.
Ongoing coverage of React2Shell