-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| RestrictedPython | pip | >= 6.0, < 8.0 | 8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The transformer allowed try/except* syntax (via visit_TryStar), and 2) ExceptionGroup was whitelisted in safe_builtins. The commit patching the vulnerability specifically modifies both - replacing visit_TryStar's permissive behavior with a denial, and removing ExceptionGroup from safe_builtins. These changes directly correlate with the described type confusion attack vector through try/except* handling in vulnerable Python versions (3.11+). The CWE-843 classification and commit message about 'sandbox escape' confirm these components were the entry points for exploitation.
Ongoing coverage of React2Shell