-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| topgrade | rust | <= 12.0.0 | 12.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from path-based directory operations that didn't maintain consistent file handles. The commit patching this (7247a8b) introduced handle-relative operations through a new RemoveDir trait and fs_at crate integration. The vulnerable functions: 1) remove_dir_all_path - directly used path-based deletion without handle consistency 2) _remove_dir_contents_path - performed recursive deletion using path checks vulnerable to symlink swaps. Both were replaced in the patch with handle-based operations using open_dir_at and file descriptor-relative paths to prevent TOCTOU races.