-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the Rust age crate's plugin handling functions that process untrusted plugin names. These functions (listed in GHSA-4fg7-vxc8-qx5w) don't properly sanitize path separators in plugin names, allowing attackers to specify malicious paths. Since pyrage is a direct binding to this vulnerable Rust crate, its exposed functionality inherits these flaws. The functions identified are the entry points for parsing/constructing plugin identities and recipients in the Rust layer, which pyrage depends on. The confidence is high because the advisory explicitly links pyrage's vulnerability to these specific Rust functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyrage | pip | >= 1.2.0, < 1.2.3 | 1.2.3 |