-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cli/cli/v2 | go | < 2.63.1 | 2.63.1 |
| github.com/cli/cli | go | <= 1.14.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) In download.go, the runDownload() function combined user-controlled artifact names with target directories without sufficient validation, particularly dangerous when artifact names contained '..'. 2) The original filepathDescendsFrom() function in zip.go had inadequate path traversal detection. The commit added critical checks in both locations - a new path validation guard clause in runDownload() and improved relative path calculation in filepathDescendsFrom(). The test cases in download_test.go specifically demonstrate handling of '..' artifact names, confirming these were the vulnerable points.
GoGoKEV Misses 88% of Exploited CVEs- Get the report