-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.4.4 | 1.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of array buffer detachment. The patch renames ClearParentsLength to DetachBufferFromParent and adds vtable switching logic for virtual typed arrays. The original function only cleared the 'length' field but didn't update the object's vtable, leaving a window where jitted code could still write to detached buffers through virtual typed array interfaces. The CWE-119 alignment (memory buffer mishandling) and commit message about preventing writes to detached buffers confirm this root cause.