-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-skynet/LocalAI | go | <= 2.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protections on state-changing API endpoints. While specific function names aren't provided in the advisory, the core issue exists in HTTP handlers that process: 1) POST requests, 2) with simple content-types, 3) for resource-intensive operations (explicitly mentioned: image generation and file uploads). These characteristics align with typical API handler functions in Go web applications. The high confidence comes from the direct match between described attack vectors (malicious form submissions exhausting resources) and the required handler functionality to implement those API endpoints.
GoGoOngoing coverage of React2Shell