-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| js-deobfuscator | npm | < 1.1.0 | 1.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using eval() to resolve expressions. The pre-patch code in expressionSimplifier.ts dynamically constructed code strings from input expressions and evaluated them using evalCodeToExpression (which used eval()). This allowed crafted payloads to escape string contexts and execute arbitrary code. The commit patched this by replacing the eval-based approach with static value resolution, removing code generation/execution entirely. The vulnerable functions directly handled code generation and evaluation of untrusted input.
JavaScriptJavaScriptOngoing coverage of React2Shell