CVE-2019-1195: Out-of-bounds write in Microsoft.ChakraCore
Summary
CVE-2019-1195: Out-of-bounds write in Microsoft.ChakraCore. Affects Microsoft.ChakraCore versions < 1.11.12. Fixed in 1.11.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is a NuGet package that provides the Chakra scripting engine used in Microsoft Edge. The Chakra scripting engine is responsible for executing JavaScript code in the browser. It is widely used for web application development and provides various features and functionalities for JavaScript execution. However, a vulnerability has been discovered in the Chakra scripting engine that allows for an out-of-bounds write, potentially leading to remote code execution.
Vulnerability Detail
The vulnerability, known as 'Chakra Scripting Engine Memory Corruption Vulnerability' (CVE-2019-1195), occurs due to improper handling of objects in memory. An attacker can exploit this vulnerability remotely to execute arbitrary code on the target system. The impact of this vulnerability can be severe, as it allows an attacker to gain control over the affected system and potentially perform unauthorized actions. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, updating the Microsoft.ChakraCore package to the latest version is the recommended solution.
Conclusion
In conclusion, the CVE-2019-1195 vulnerability in the Microsoft.ChakraCore package poses a high risk due to its potential for remote code execution. It is crucial for developers to update their applications to the latest version of the package to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
The vulnerability allows for remote code execution, potentially enabling an attacker to take control of the affected system and perform unauthorized actions.
Updating the Microsoft.ChakraCore package to version 1.11.12 or later will address the vulnerability and reduce the risk of exploitation.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the recommended update to mitigate the risk.
Yes, this vulnerability can be exploited remotely, allowing an attacker to execute arbitrary code on the target system.
For more information about this vulnerability, you can refer to the CVE-2019-1195 advisory and the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
