-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.7.3 | 1.7.3 |
Miggo AIRoot Cause AnalysisThe commit diff shows critical changes in JavascriptProxy.cpp's proxy function call handling. The patch introduces a conditional check (isNewCall) to determine whether to include the NewTarget flag and the newTarget argument. Previously, these were always added, regardless of whether the call was a constructor. This mismatch between argument count preparation and actual usage could corrupt memory buffers, enabling RCE. The CWE-119 alignment and the explicit fix for 'unnecessary NewTarget passing' confirm this is the root cause.
Ongoing coverage of React2Shell