-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/snapcore/snapd | go | >= 2.51.6, < 2.63.1 | 2.63.1 |
| github.com/snapcore/snapd | go | < 0.0.0-20240524114846-68ee9c6aa916 | 0.0.0-20240524114846-68ee9c6aa916 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper argument parsing in the authorization check function. The commit diff shows the vulnerable isAllowedToRun function was modified to add proper '--' handling. The original code allowed any occurrence of help flags (even after command arguments) to bypass root checks, which attackers exploited by inserting '-- --help' to trigger the bypass. The patch specifically addresses this by terminating argument parsing at '--', confirming this function's role in the vulnerability.
Ongoing coverage of React2Shell