-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| agentscope | pip |
Miggo AIRoot Cause AnalysisThe _read_examples endpoint directly uses the user-provided 'file_index' parameter to construct a file path without validating or normalizing it. This allows path traversal attacks (e.g., using '../../' sequences) to access arbitrary JSON files. The vulnerability matches CWE-22 (Path Traversal) and CWE-73 (External Control of File Path), as confirmed by the advisory's description of being able to read any local JSON file through crafted requests.
PythonPythonOngoing coverage of React2Shell