-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 5.0, < 5.0.8 | 5.0.8 |
| Django | pip | >= 4.2, < 4.2.15 | 4.2.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two components: 1) urlize/urlizetrunc's regex-based URL detection lacked input length checks, allowing ReDoS via crafted Unicode strings. 2) AdminURLFieldWidget's href generation used value presence instead of URL validity, permitting invalid oversized inputs. The patches explicitly address these with length limits (MAX_URL_LENGTH) and validation checks, as seen in the commit diffs. The CWE-1333 (regex complexity) and CWE-1284 (input validation) align with these fixes.