-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description directly implicates archiver.Unarchive as the function processing the malicious input (crafted ZIP file) and performing the unsafe extraction. The provided commit, although only a README update, confirms the project's stance on not mitigating this specific vulnerability within its extraction functionalities. The deprecation of the project and removal of Unarchive() in its successor further supports that this function was the core of the issue. While the exact file path for archiver.go is an assumption based on common Go project structures and the function name, the function signature archiver.Unarchive is clearly identified as vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mholt/archiver | go | <= 3.5.1 | |
| github.com/mholt/archiver/v3 | go | <= 3.5.1 |
GoGoOngoing coverage of React2Shell