-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| torchgeo | pip | >= 0, < 0.6.1 | 0.6.1 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from improper code injection via eval() in the model weight API. The GitHub PR #2323 explicitly shows removal of eval() usage in get_weight function to fix security issues. The CVE description and patch notes confirm this was the attack vector. The eval() function in get_weight allowed execution of arbitrary strings passed as weight identifiers, matching CWE-94 (Code Injection) characteristics.