CVE-2017-0235: ChakraCore RCE Vulnerability in Microsoft.ChakraCore
Summary
CVE-2017-0235: ChakraCore RCE Vulnerability. Affects Microsoft.ChakraCore versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is a JavaScript engine used by Microsoft Edge for rendering web pages. It is responsible for executing JavaScript code and providing the necessary functionality for web applications. The ChakraCore engine is vulnerable to a remote code execution (RCE) vulnerability, known as CVE-2017-0235 or "Scripting Engine Memory Corruption Vulnerability." This vulnerability occurs when handling objects in memory, allowing an attacker to execute arbitrary code on the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
Vulnerability Detail
The ChakraCore RCE vulnerability in Microsoft Edge's JavaScript engine can be exploited by an attacker to execute arbitrary code remotely. By manipulating objects in memory, an attacker can corrupt the scripting engine, leading to the execution of malicious code. This vulnerability poses a significant risk as it allows an attacker to gain control over the affected system, potentially leading to further compromise, data theft, or unauthorized access. It is important to note that this vulnerability is distinct from other CVEs related to ChakraCore.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to update the Microsoft.ChakraCore package to the latest version as mentioned in the 'how_to_fix' section to address the vulnerability effectively.
Conclusion
The ChakraCore RCE vulnerability in the Microsoft.ChakraCore package used by Microsoft Edge poses a significant risk to the security of systems running affected versions. It is crucial to update the package to the latest version (1.4.4 or later) to patch the vulnerability and prevent potential exploitation. Regularly checking for updates and implementing security best practices can help mitigate the risk of this vulnerability. For further assistance or information on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
The ChakraCore RCE vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to complete control over the affected system. This can result in unauthorized access, data theft, or further compromise of the system.
Yes, this vulnerability affects Microsoft Edge as it relies on the ChakraCore JavaScript engine for rendering web pages.
Specific instances of exploitation may vary, but it is crucial to address this vulnerability promptly by updating the Microsoft.ChakraCore package to the latest version.
Updating the Microsoft.ChakraCore package is the recommended approach to mitigate this vulnerability. However, implementing additional security measures, such as network firewalls and intrusion detection systems, can provide an extra layer of defense against potential attacks.
For more information about this vulnerability, you can refer to the CVE-2017-0235 entry or reach out to info@devnack.com for further support on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
