-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how Buffer's underlying ArrayBuffer was directly referenced (via .buffer property) when creating the 'Integrity' resource entry. Node.js Buffers are views over larger ArrayBuffers, and using .buffer exposes adjacent memory. The patch changed this to use the Buffer directly (without .buffer dereference) and explicitly specified UTF-8 encoding, ensuring only intended data is included. The resedit function in src/resedit.ts was directly modified in the security patch to address this specific memory exposure issue.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @electron/packager | npm | = 18.3.0 | 18.3.1 |
Ongoing coverage of React2Shell