-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langflow | pip | <= 1.0.18 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the /api/v1/validate/code endpoint's handling of code validation. The provided PoC demonstrates that when user-supplied code containing function definitions with malicious default parameters (e.g., eval('import("os").system("ls")')) is processed, the backend uses exec() to execute the code in the local environment. This matches the CWE-94 description of code injection and aligns with the GHSA advisory's statement about components running without sandboxing. The test case in Issue #696 directly shows RCE through this endpoint, confirming the vulnerable code path.
Ongoing coverage of React2Shell