Threats affecting pkg:github/666ghj/MiroFish

CVE-2026-7059 is a path traversal vulnerability in the 666ghj MiroFish application versions up to 0.1.2. It affects the get_simulation_posts function in the backend/app/api/simulation.py file, specifically the Query Parameter Handler component. An attacker can remotely manipulate the Platform argument to perform path traversal. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-7058 is a command injection vulnerability in the 666ghj MiroFish product versions up to 0.1.2. The flaw exists in the SimulationIPCClient.send_command function within the Inter-Process Communication component. This vulnerability allows remote attackers to execute arbitrary commands. The issue has been publicly disclosed and an exploit is available, but the vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating medium severity.

CVE-2026-7042 is a medium severity vulnerability in 666ghj MiroFish versions up to 0.1.2. It involves missing authentication in the create_app function of the REST API endpoint, allowing remote attackers to manipulate the application without proper authentication. Although an exploit has been published, the vendor has not yet responded or issued a fix. No official patch or remediation guidance is currently available.

CVE-2026-7041 is an information disclosure vulnerability in 666ghj MiroFish versions up to 0.1.2. It affects an unknown function in the Werkzeug Debugger PIN Handler component, specifically in the /console file. The vulnerability can be triggered remotely by manipulating the SECRET argument. Exploitation is considered difficult due to high attack complexity. Although the exploit is publicly available, there is no vendor response or patch at this time. The CVSS 4.0 base score is 6.3, indicating medium severity.