-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.16 | 1.11.16 |
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stems from improper scope management for functions declared in parameter lists. The commit diff shows critical modifications to: 1) Symbol binding logic (BindPidRefsInScope) to handle parameter-scope function declarations, 2) Function declaration flags (ParseFncDeclInternal) to track parameter-scope origins, and 3) Bytecode emission logic (StartEmitFunction) to handle merged scopes. These functions directly correlate with the CWE-787/CWE-119 descriptions of out-of-bounds writes and memory corruption through improper scope handling, as evidenced by the added test cases validating parameter-scope function behavior.
Ongoing coverage of React2Shell