-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper domain comparison in the blocklist check. The commit diff shows the fix added .strip('.') to domain/value comparisons in isInList, proving this was the vulnerable function. The test case added in safeurl_tests.py demonstrates the bypass scenario using a trailing dot, which this function's logic failed to handle before the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| SafeURL-Python | pip | < 1.3 | 1.3 |
Ongoing coverage of React2Shell