-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.2.2 | 1.2.2 |
Miggo AIRoot Cause AnalysisThe commit diff shows critical safety checks being added to: 1) eval's CallFlags handling (GlobalObject.cpp), 2) Array prototype methods (JavascriptArray.cpp) adding native array conversions, 3) JSON parser array handling, and 4) ArraySpeciesCreate species validation. These directly correlate to the CWE-119 memory corruption described, with test cases demonstrating type confusion scenarios in filter/splice/eval operations. The patch patterns (EnsureNonNativeArray, CheckAndConvertCopyOnAccess, isDirectEvalCall) indicate these were the vulnerable entry points.