CVE-2017-11767: ChakraCore Privilege Escalation in Microsoft.ChakraCore
Summary
CVE-2017-11767: ChakraCore vulnerable to privilege escalation. Affects Microsoft.ChakraCore versions < 1.6.2. Fixed in 1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is a scripting engine that is used by various applications to execute JavaScript code. It is commonly used in web browsers and other software that incorporates JavaScript functionality. ChakraCore provides a platform for running JavaScript code and interacting with the host application. However, a vulnerability has been discovered in ChakraCore that allows an attacker to gain the same user rights as the current user. This vulnerability arises from the way ChakraCore handles objects in memory, leading to a memory corruption issue. The impact of this vulnerability can be severe, as an attacker with elevated privileges can perform unauthorized actions and potentially compromise the system.
Vulnerability Detail
The ChakraCore scripting engine in Microsoft.ChakraCore is susceptible to a privilege escalation vulnerability. This vulnerability, identified as CVE-2017-11767, allows an attacker to gain the same user rights as the current user. The vulnerability arises from the improper handling of objects in memory by ChakraCore. By exploiting this vulnerability, an attacker can execute arbitrary code with elevated privileges, potentially leading to unauthorized access, data theft, or system compromise. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can consider implementing additional security measures to mitigate the risk posed by this vulnerability. This may include implementing access controls, privilege separation, and input validation to prevent unauthorized access and limit the impact of potential exploits. However, applying the recommended fix by updating the Microsoft.ChakraCore package to the latest version is the most effective way to address the vulnerability.
Conclusion
The ChakraCore Privilege Escalation vulnerability in Microsoft.ChakraCore poses a significant risk to applications utilizing this scripting engine. It allows an attacker to gain elevated privileges and potentially compromise the system. To mitigate this vulnerability, it is crucial to update the Microsoft.ChakraCore package to version 1.6.2 or later. Regularly monitoring for security updates and promptly applying them is essential to maintain the security of the software. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
ChakraCore is a scripting engine developed by Microsoft that allows the execution of JavaScript code in various applications, including web browsers.
This vulnerability allows an attacker to gain the same user rights as the current user, potentially leading to unauthorized access, data theft, or system compromise.
To fix this vulnerability, update the Microsoft.ChakraCore package to version 1.6.2 or later.
While implementing additional security measures can help mitigate the risk, updating the Microsoft.ChakraCore package to the latest version is the recommended solution.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
