-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| exiftool_vendored | rubygems | < 12.25.0 | 12.25.0 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability (CVE-2021-22204) stems from improper handling of DjVu annotation chunks. ExifTool's DjVu.pm module processes ANT chunks using the system() function with unsanitized input from file metadata. This matches the CWE-74 injection pattern and the exploit methodology observed in real-world attacks where crafted metadata triggers command execution. The function name and file path are consistent with ExifTool's structure and historical vulnerability disclosures.