-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ckb | rust | <= 0.34.1 | 0.34.2 |
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems from transaction validation in the tx-pool having access to cell data when it shouldn't. The patched versions introduce a 'with_data' parameter to CellProvider implementations that clears mem_cell_data when false. The vulnerable functions are the original implementations of CellProvider::cell() in these components that didn't include this conditional data clearing, allowing load_cell_data_hash syscalls to see live data during tx-pool validation rather than empty data. This made transaction verification nondeterministic as cell data could change between pool validation and block inclusion.
Ongoing coverage of React2Shell