-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/go-slug | go | < 0.16.3 | 0.16.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a zip slip attack, which occurs during file extraction when path validation is insufficient. The provided commit fbb041690f076f8e983a0f5f0d7406545a41359a directly addresses this by enhancing path sanitization within the NewUnpackInfo function in internal/unpackinfo/unpackinfo.go. This function takes the destination directory and tar header as input, and its core logic involves determining the final extraction path. The changes in the patch, such as ensuring the destination path ends with a slash and robustly checking if the target path is within the destination, clearly indicate that NewUnpackInfo was the function where the vulnerability existed. The vulnerability description confirms that the issue lies in how header.Name is processed during unpacking.
Ongoing coverage of React2Shell