-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zenml | pip | < 0.57.1 | 0.57.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing input validation in entity creation endpoints. The patch adds 'validate_name()' checks to these functions in sql_zen_store.py, which explicitly prevents '\n' characters. The functions listed above are the API entry points that handled user-supplied names without proper validation in vulnerable versions. Test cases in the commit demonstrate these were the affected code paths (e.g., test_stack_component_create_fails_with_invalid_name). The high confidence comes from direct evidence in the patch showing validation was added to these specific functions.
Ongoing coverage of React2Shell