-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.17 | 1.11.17 |
Miggo AIRoot Cause AnalysisThe commit diff shows critical changes in how EvalMapString keys are handled in AddToEvalMapHelper. The vulnerability description specifically mentions improper memory handling of objects, and the fix introduced a copy operation for external buffers. The pre-patch code lacked ownership tracking (evident from the added 'owningVar' field) and could store transient buffers, making ScriptContext::AddToEvalMapHelper the primary vulnerable function.
C#C#Ongoing coverage of React2Shell