-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/patrickhener/goshs | go | >= 0.3.4, <= 1.0.4 | 1.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions the dispatchReadPump function as the source of the issue, stating it doesn't check the CLI option -c. The provided commit 160220974576afe5111485b8d12fd36058984cfa modifies this function in ws/client.go. The diff shows that the code responsible for unmarshaling and executing the command, previously unconditional, is now wrapped in an if c.hub.cliEnabled block. This confirms that dispatchReadPump was the function that improperly handled command execution. The changes in httpserver/server.go (passing fs.CLI to NewHub) and ws/hub.go (adding cliEnabled to the Hub struct and NewHub constructor) are part of the fix to correctly propagate the command-line interface setting to the websocket handler, enabling the check in dispatchReadPump. Therefore, ws.Client.dispatchReadPump is the function that directly processes the potentially malicious input and executes commands, making it the vulnerable function.
A Semantic Attack on Google Gemini - Read the Latest Research