{"id":"CVE-2018-8298","kind":"vulnerability","aliases":["CVE-2018-8298"],"related":[],"title":"ChakraCore ChakraCore scripting engine: ChakraCore Scripting Engine Type Confusion Vulnerability","description":"A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.","summary":"Type confusion/memory corruption in the ChakraCore JavaScript engine (Intl InitializeNumberFormat/InitializeDateTimeFormat bugs) gives remote code execution as the current user when the engine runs attacker-controlled script. Fixed in the July 2018 security update (ChakraCore 1.10.1). In CISA KEV. ChakraCore is no longer maintained by Microsoft, so embedders must be on 1.10.1 or later.","severity":"critical","cvss":7.6,"epss":0.74694,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"ChakraCore ChakraCore scripting engine","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ChakraCore","fixed":["1.10.1"],"affected":"< 1.10.1","ecosystem":"vendor"},{"name":"Microsoft.ChakraCore","fixed":["1.10.1"],"affected":"< 1.10.1","ecosystem":"nuget"}],"ecosystems":["nuget","vendor"],"tags":["chakracore","embedded-engine","exploited","javascript","microsoft","nuget","runtime"],"not_affected_if":["not-embedding-chakracore","unknown","version-1.10.1-or-later"],"how_to_check":"Find ChakraCore in your app: NuGet Microsoft.ChakraCore package version (dotnet list package | look for < 1.10.1), or the ChakraCore.dll/libChakraCore file version or embedded build. Anything older than 1.10.1 is vulnerable.","fix":"Upgrade to ChakraCore / Microsoft.ChakraCore 1.10.1 or later (prefer the last 1.11.x, 1.11.24). Do not run untrusted JavaScript in old embedded builds.","status":"open","published_at":"2018-07-11T00:29:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:24:31+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:24:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions; the sources do not name a fixed version.","reach":"unknown","impact":"high","summary":"ChakraCore is the JavaScript scripting engine used by some Microsoft software; a type confusion flaw in it lets an attacker run code. The sources say it is exploited in the wild and list it in CISA's Known Exploited Vulnerabilities catalog.","category":"runtime","who_cares":["chakracore","microsoft","javascript"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code remotely through crafted script processed by the engine","analyst_note":"Find the affected and fixed ChakraCore versions and the vendor advisory from the Microsoft security response entry for CVE-2018-8298; the sources do not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000459,"input_tokens":2834,"output_tokens":351,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed ChakraCore versions and the vendor advisory from the Microsoft security response entry for CVE-2018-8298; the sources do not list them.","search":"'-2018':12A,15A,120C,123C,126C,129C,132C,135C '-8242':121C '-8283':124C '-8287':127C '-8288':130C '-8291':133C '-8296':136C '-8298':13A,16A '1.10.1':67B,83B '2018':63B 'affect':111C 'aka':104C 'attack':56B 'attacker-control':55B 'bug':42B 'chakracor':1A,2A,5A,23B,37B,66B,71B,97C,112C 'chakracore':17A,18A,21A 'cisa':69B 'code':45B,88C 'confus':9A 'confusion/memory':33B 'control':57B 'corrupt':34B,108C 'current':49B 'cve':11A,14A,114C,119C,122C,125C,128C,131C,134C 'embed':25B 'embedd':79B 'embedded-engin':24B 'engin':4A,7A,26B,39B,53B,99C,106C 'engine':20A 'execut':46B,89C 'exist':91C 'exploit':27B 'fix':59B 'give':43B 'handl':100C 'id':115C 'initializenumberformat/initializedatetimeformat':41B 'intl':40B 'javascript':28B,38B 'juli':62B 'kev':70B 'later':85B 'longer':74B 'maintain':75B 'memori':103C,107C 'microsoft':29B,77B 'microsoft.chakracore':22A 'must':80B 'nuget':30B 'object':101C 'remot':44B,87C 'run':54B 'runtim':31B 'script':3A,6A,58B,98C,105C 'scripting':19A 'secur':64B 'type':8A,32B 'uniqu':117C 'updat':65B 'user':50B 'vulner':10A,90C,109C 'way':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-07-11T00:29:01+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8298","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8298","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8298","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8298","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2018-8298:73","url":null,"severity":null,"published_at":"2026-10-23T21:25:56+00:00","modified_at":"2026-10-23T21:25:56+00:00","first_seen_at":"2026-10-23T21:25:56+00:00","fetched_at":"2026-10-23T21:25:56+00:00","note":"MSRC advisory (Jul 10 2018, Lokihardt/Project Zero) plus GHSA give fix in ChakraCore 1.10.1; MSRC itself said Exploited: No at release, exploitation status comes from CISA KEV. No public PoC found. Fix commit cb9957e in July 2018 PR #5444."},{"source":"nvd","external_id":"CVE-2018-8298","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8298","severity":null,"published_at":"2018-07-11T00:29:01+00:00","modified_at":"2026-06-17T02:04:35+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1011,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8298","title":"MSRC CVE-2018-8298","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1012,"url":"https://github.com/advisories/GHSA-wgw2-wwq8-c7wf","title":"GHSA-wgw2-wwq8-c7wf Microsoft.ChakraCore < 1.10.1","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1013,"url":"https://github.com/chakra-core/ChakraCore/pull/5444","title":"ChakraCore July 2018 Security Update PR #5444","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}