CVE-2019-1024: ChakraCore RCE Vulnerability in Microsoft.ChakraCore
Summary
CVE-2019-1024: Chakra Scripting Engine RCE Vulnerability. Affects Microsoft.ChakraCore versions < 1.11.10. Fixed in 1.11.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is a NuGet package that provides the Chakra scripting engine used in Microsoft Edge. It is responsible for executing JavaScript code in the browser. ChakraCore is widely used and plays a critical role in the functionality of Microsoft Edge. However, a remote code execution vulnerability has been discovered in ChakraCore, which can allow an attacker to execute arbitrary code on a user's system.
Vulnerability Detail
The ChakraCore RCE vulnerability arises from a memory corruption issue in the Chakra scripting engine. Specifically, it mishandles objects in memory, leading to a remote code execution scenario. An attacker can exploit this vulnerability by crafting a malicious website or convincing a user to visit a specially crafted webpage. If successful, the attacker can execute arbitrary code within the context of the user's browser, potentially compromising the user's system and data. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the Microsoft.ChakraCore package to the latest version.
Conclusion
The ChakraCore RCE vulnerability in the Microsoft.ChakraCore package poses a significant risk to systems utilizing the Chakra scripting engine. It is crucial to update the package to the latest version to mitigate the vulnerability and prevent potential remote code execution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
This vulnerability allows an attacker to execute arbitrary code on a user's system, potentially leading to system compromise, data theft, or unauthorized access.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
While there is no specific information about known exploits, it is important to address this vulnerability promptly by updating the Microsoft.ChakraCore package to the latest version.
The only effective mitigation for this vulnerability is to update the Microsoft.ChakraCore package to the latest version. It is crucial to keep all software components up to date to minimize the risk of exploitation.
For more information about this vulnerability, you can refer to the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g8q3-rcf9-qx4q/GHSA-g8q3-rcf9-qx4q.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.