-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bostr | npm | < 3.0.10 | 3.0.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from line 21 in auth.js (pre-patch) where authorization logic improperly handled the noscraper flag. The original condition if (!authorized_keys?.includes(...) && !private_keys[...] && !noscraper) would evaluate to false when noscraper=true, bypassing the authorization check entirely. The module export function in auth.js is the authentication entrypoint that contained this flawed logic, making it the vulnerable function. The commit diff and CVE description both explicitly reference this code path as the root cause.
A Semantic Attack on Google Gemini - Read the Latest Research