-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elliptic | npm | >= 4.0.0, <= 6.5.6 | 6.5.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing signature length validation in EDDSA implementation. The commit accb61e adds a critical assertion (assert(sig.length === eddsa.encodingLength * 2)) in lib/elliptic/eddsa/signature.js to fix this. The original code in Signature constructor processed arbitrary-length arrays, enabling signature malleability through zero-byte manipulation. This matches the CVE description of 'missing signature length check' allowing byte modification.
JavaScriptJavaScriptOngoing coverage of React2Shell