-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) In AddModuleLocalExportEntry, the Assert() was insufficient to prevent invalid node types (changed to AssertOrFailFast in the patch). 2) ParseExportDeclaration's list traversal didn't account for assignment nodes (knopAsg) in destructuring patterns. The commit diff shows these functions were modified to add destructuring node handling (MapBindIdentifier) and stricter validation, directly addressing the type confusion described in CWE-119.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.7.4 | 1.7.4 |
Ongoing coverage of React2Shell