-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from improper argument handling in the SSH server's environment variable processing. The code in internal/ssh/ssh.go directly passes user-controlled input (env.Name and env.Value) to the 'env' command without proper sanitization. This allows attackers to inject the '--split-string' argument which enables command execution through argument splitting. The analysis from SonarSource explicitly identifies this code path and demonstrates how the env command's --split-string parameter can be abused for RCE. The CWE-88 classification (Argument Injection) and technical details from multiple sources confirm this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gogs/gogs | go | <= 0.13.0 |
Ongoing coverage of React2Shell