-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.inlong:tubemq-core | maven | >= 1.10.0, < 1.13.0 | 1.13.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the unwrapException function's handling of exception messages. The commit diff shows it previously used 'Class.forName()' on user-controlled input without verifying if the class was a Throwable subclass. This allowed injection of arbitrary classes (code execution vector). The patch adds 'Throwable.class.isAssignableFrom(clazz)' validation, confirming this was the exploit path. The CWE-94 classification and RCE impact further align with this code pattern.
Ongoing coverage of React2Shell