-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pullit | npm | < 1.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using execSync with template strings containing user-controlled branch names (${branch}). This allowed command injection by including malicious commands in branch names. The commit replaced execSync with execFileSync with separate arguments, eliminating shell interpretation. While original advisories mention eval(), the actual vulnerable pattern was unsafe command construction via execSync.
A Semantic Attack on Google Gemini - Read the Latest Research