-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/sqls-server/sqls | go | = 0.2.28 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the openEditor function in main.go. The function was responsible for opening the configuration file in an editor. The vulnerability was introduced by the use of exec.Command("sh", "-c", command), which passes the command to the shell for execution. The command variable was constructed by concatenating the editor program (from the EDITOR environment variable) and the file path. An attacker could set a malicious EDITOR environment variable (e.g., vim; id) to execute arbitrary commands. The patch fixes this by using exec.Command(program, args...), which executes the program directly without a shell, thus preventing command injection.
openEditormain.go
Ongoing coverage of React2Shell