-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/lf-edge/ekuiper | go | < 1.14.2 | 1.14.2 |
| ekuiper | pip | >= 0, < 1.14.2 | 1.14.2 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from string concatenation of user-controlled input (key parameter) into SQL queries across multiple functions in sqlKv.go. The original code used fmt.Sprintf to directly embed user input into query strings (e.g., "WHERE key='%s'"), rather than using parameterized queries. This pattern is visible in:
The commit diff shows these were fixed by switching to prepared statements with '?' placeholders. The PoC demonstrates exploitation through the explainRuleHandler which passes user input to these vulnerable functions. High confidence comes from direct code evidence, CWE-89 classification, and the explicit patch strategy.
Ongoing coverage of React2Shell