CVE-2020-0813: ChakraCore information disclosure vulnerability in Microsoft.ChakraCore
Summary
CVE-2020-0813: ChakraCore information disclosure vulnerability. Affects Microsoft.ChakraCore versions < 1.11.17. Fixed in 1.11.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.ChakraCore is an open-source JavaScript engine used by various applications to interpret and execute JavaScript code. It is commonly utilized in web browsers, server-side applications, and other software that requires JavaScript functionality. ChakraCore provides a runtime environment for JavaScript, allowing developers to create interactive and dynamic web applications. However, a vulnerability has been identified in ChakraCore that could lead to information disclosure.
Vulnerability Detail
The ChakraCore information disclosure vulnerability (CVE-2020-0813) occurs when Chakra improperly exposes the contents of its memory. This flaw could be exploited by an attacker who knows the memory address of a specific object created by Chakra. By exploiting this vulnerability, an attacker could gain access to sensitive information, potentially compromising the user's computer or data. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by updating their Microsoft.ChakraCore package to the fixed version (1.11.17) as mentioned in the 'how_to_fix' section.
Conclusion
The ChakraCore information disclosure vulnerability (CVE-2020-0813) in the Microsoft.ChakraCore package exposes the contents of its memory, potentially compromising user data. To mitigate this risk, users should update their ChakraCore installations to version 1.11.17 or later. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
ChakraCore is an open-source JavaScript engine developed by Microsoft. It is used in various applications to interpret and execute JavaScript code.
The vulnerability allows an attacker to access the contents of ChakraCore's memory, potentially leading to further compromise of the user's computer or data.
To fix this vulnerability, update your Microsoft.ChakraCore package to version 1.11.17 or later.
There is no specific workaround provided, but updating to the fixed version of Microsoft.ChakraCore mitigates the risk.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.