Loading HuntDB...

GHSA-735f-mx7h-46w8

GitHub Security Advisory

ChakraCore vulnerable to remote code execution due to insufficient InlineCache check

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". An insufficient `InlineCache` check can lead to type confusion, which could potentially allow for remote code execution.

This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Affected Packages

NuGet Microsoft.ChakraCore
Affected versions: 0 (fixed in 1.7.5)

Related CVEs

Key Information

GHSA ID
GHSA-735f-mx7h-46w8
Published
May 17, 2022 12:11 AM
Last Modified
October 10, 2023 4:17 PM
CVSS Score
7.5 /10
Primary Ecosystem
NuGet
Primary Package
Microsoft.ChakraCore
GitHub Reviewed
✓ Yes

Dataset

Last updated: June 17, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.