-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization using ObjectInputStream in decode methods. Both Java and Kotlin implementations directly deserialized data without restricting allowed classes, enabling arbitrary object instantiation. The patch introduces StringListObjectInputStream with an allowlist to restrict deserialization, confirming these decode functions were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shared_preferences_android | pub | = 2.3.3 | 2.3.4 |
DartDartKEV Misses 88% of Exploited CVEs- Get the report