-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| storlets | pip | < 13.0.0.0rc1 | 13.0.0.0rc1 |
Miggo AIRoot Cause AnalysisThe commit diff shows critical changes to file permission handling in bring_from_cache. The vulnerability stemmed from: 1) Creating directories with 755 permissions instead of 700, 2) Writing file contents before setting permissions via chmod. This created a race condition where an attacker could access files during the window between write and permission change. The patch fixes this by setting permissions (0o700) before writing content and moving chmod earlier in the process flow, directly addressing the TOCTOU vulnerability (CWE-367) through proper atomicity in file operations.
A Semantic Attack on Google Gemini - Read the Latest Research