-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pymongo | pip | < 4.6.3 | 4.6.3 |
Miggo AIRoot Cause AnalysisThe provided commit directly patches the get_value function in bson/_cbsonmodule.c. The changes involve adding stricter and more comprehensive size checks for code_size and scope_size when parsing BSON elements of type _BINARY_JAVASCRIPT_WITH_SCOPE. The vulnerability description states that a crafted payload could force the parser to deserialize unmanaged memory due to an out-of-bounds read. The patch addresses this by ensuring that the declared sizes for the JavaScript code and its scope, along with other metadata, do not exceed the available buffer (max) and are internally consistent (e.g., len < code_size or len < scope_size checks for overflow). The get_value function is where this parsing and validation occurs, making it the direct site of the vulnerability.
Ongoing coverage of React2Shell