-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | < 1.8.1 | 1.8.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper authentication checks in the middleware handling /api/v1 routes. The original implementation used non-regex string matching (req.url.includes()) which was case-sensitive. Attackers could bypass authentication by using alternate casing in the URL path. The patch introduced case-insensitive regex matching (/api/v1/ with 'i' flag), confirming this was the vulnerable code path. This authentication bypass would let attackers reach protected endpoints that might execute untrusted code.
Ongoing coverage of React2Shell