-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization of Iced-formatted models. The Iced serialization framework is core to H2O's object transmission, and the read_impl method (or equivalent deserialization entry point) would be responsible for reconstructing objects from serialized data. The advisory explicitly states there's no class whitelist during deserialization, which would typically be enforced in the object deserialization implementation. While exact implementation details aren't available, H2O's Iced class is the logical location for serialization/deserialization logic based on documentation of its architecture.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ai.h2o:h2o-core | maven | <= 3.46.0.4 |
Ongoing coverage of React2Shell