-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | < 0.20 | 0.20 |
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability is based on the provided commit 909e5c97885237530d1264cfceb5555870eb9546. The commit shows a change in src/pyload/webui/app/static/js/captcha-interactive.user.js, where a call to eval() is replaced. The vulnerable code is within an anonymous function registered as a message event listener. This listener parses the event data and executes a script contained within it using eval(). This is a classic code injection vulnerability. An attacker can craft a malicious message to the browser window, which, when processed by this event listener, will execute arbitrary JavaScript. This can be used to steal session cookies, perform actions on behalf of the user, or pivot to other attacks. The root cause is the direct use of eval() on untrusted input. The provided patch mitigates this by using new Function() to execute the code in a sandboxed environment, preventing it from accessing the surrounding scope and sensitive data.