-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| frappe | pip | ||
| frappe | pip |
Miggo AIRoot Cause AnalysisThe key vulnerability stems from the build_filter_conditions method in db_query.py. The patch shows that raw string filters were previously appended directly to SQL conditions (conditions.append(f)), which is unsafe. The fix introduced sanitize_column(f) to validate/escape column names. This matches the CWE-89 (SQL Injection) description, as improper neutralization of user input in SQL commands was the root cause. Other changes (e.g., HTML sanitization in setup_wizard) are unrelated to SQL injection mitigation. The db_query.py change is the most direct and conclusive fix for the described vulnerability.
PythonPythonOngoing coverage of React2Shell