-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| json | rubygems | >= 2.10.0, <= 2.10.1 | 2.10.2 |
RubyRubyMiggo AIRoot Cause AnalysisThe commit diff shows a critical boundary check addition in json_string_unescape function. The original code used 'while ((pe = memchr(...)))' without validating 'pe' stays within 'stringEnd'. The patch adds 'pe < stringEnd' check to prevent OOB read. This matches the CWE-125 description and advisory's focus on unescape handling. No other code changes were made in the security-relevant commit.
Ongoing coverage of React2Shell