-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.16 | 1.11.16 |
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stems from improper scope validation when handling Yield/Await operators. The commit d898026 fixed this by introducing AncestorScopeIsParameter() checks in Parse.cpp. The original code only checked immediate parent scopes (ScopeType_Parameter or direct child Block scope), which could allow Yield/Await in nested scopes within parameter contexts. This insufficient validation could lead to memory corruption through malformed AST generation or incorrect memory operations when processing these forbidden operators in parameter-related scopes, aligning with CWE-787 (out-of-bounds write) and CWE-119 (memory buffer issues). The direct modification to ParseExpr's validation logic indicates this was the vulnerable entry point.