-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @alizeait/unflatto | npm | < 1.0.3 | 1.0.3 |
Miggo AIRoot Cause AnalysisThe core vulnerability existed in the unflatto function's property assignment logic, which previously didn't validate keys for prototype pollution vectors. The security patch adds explicit checks for 'prototype', 'proto', and 'constructor' keys during the unflattening process. This function is directly referenced in all vulnerability reports and the CVE description as the entry point for prototype pollution. The commit diff shows critical security controls were added to this specific function, confirming it was the vulnerable component.
JavaScriptJavaScriptOngoing coverage of React2Shell