-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lunary | npm | < 1.4.9 | 1.4.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from multiple CRUD handlers in the datasets API endpoint that failed to properly validate() project ownership through JOINs with the dataset table. The commit fixes show consistent pattern of adding 'd.project_id = ${projectId}' checks across all operations. Each vulnerable function corresponds to an API route that previously executed SQL queries without proper authorization context, allowing cross-organization dataset manipulation. The frontend changes are unrelated to the access control issue.
Ongoing coverage of React2Shell