-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub patch modifies ValueNumberDst in GlobOpt.cpp to add .SetCanBeTaggedValue(false) when creating object values. This indicates the vulnerability stemmed from improper type tagging checks in this function. The CWE-787 (out-of-bounds write) and exploit PoC showing type confusion via 'this[0]' manipulation confirm that incorrect type handling in object operations was the root cause. The direct correlation between the patch location and the vulnerability description provides high confidence in this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.8.1 | 1.8.1 |