-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/stripe/stripe-cli | go | >= 1.11.1, < 1.21.3 | 1.21.3 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from processing plugin archives with malformed shortnames. The key functions would be those responsible for 1) parsing plugin manifests to get the shortname, and 2) using that shortname to determine file paths during installation. Without proper path sanitization (e.g., checking for directory traversal sequences), these functions would allow writing files outside the intended directory. The medium confidence reflects the lack of direct code/patch access, but the description strongly implies these components were involved given the --archive-url/--archive-path attack vector and CWE-22 classification.
Ongoing coverage of React2Shell