-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wiki | pip | < 0.10.1 | 0.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from three key areas: 1) In wiki_tags.py, user-controlled 'keyword' was directly interpolated into a regex without escaping, enabling regex injection. 2) The FENCED_BLOCK_RE regex in codehilite.py had a complex pattern vulnerable to backtracking attacks, as evidenced by its replacement with Python-Markdown's safer regex. 3) MACRO_RE's original pattern allowed unbounded backtracking in macro parameter parsing. The commit fixes these by adding re.escape(), adopting upstream regex patterns, and constraining quantifiers, confirming these were the vulnerable points.
PythonPython