-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIA Semantic Attack on Google Gemini - Read the Latest Research
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| serde-json-wasm | rust | = 1.0.0 | 1.0.1 |
| serde-json-wasm | rust | < 0.5.2 | 0.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from recursive parsing of JSON structures without depth tracking. The commit diff shows critical additions: 1) A 'remaining_depth' field in Deserializer 2) check_recursion! macro enforcing depth limits 3) Error type for recursion limits. The vulnerable functions are the array/map/enum handlers that were wrapped with the new recursion checks in the patch. These functions (visit_seq, visit_map, visit_enum) implement recursive descent parsing and would push stack frames for each nesting level. Without the depth counter and early termination, malicious nested structures could exhaust the call stack.