Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gch5-djz8-bfhr
Vulnerability ID VCID-gch5-djz8-bfhr
Aliases CVE-2019-0649
GHSA-6c6r-39cv-x5fq
Summary Privilege Escalation A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.09543 https://api.first.org/data/v1/epss?cve=CVE-2019-0649
cvssv3.1 8.1 https://github.com/chakra-core/ChakraCore
generic_textual HIGH https://github.com/chakra-core/ChakraCore
cvssv3.1 8.1 https://github.com/chakra-core/ChakraCore/commit/beba75a1aed0933cf3c76efb4dc67529dc035901
generic_textual HIGH https://github.com/chakra-core/ChakraCore/commit/beba75a1aed0933cf3c76efb4dc67529dc035901
cvssv3.1 8.1 https://github.com/chakra-core/ChakraCore/pull/5936
generic_textual HIGH https://github.com/chakra-core/ChakraCore/pull/5936
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2019-0649
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-0649
cvssv3.1 8.1 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649
generic_textual HIGH https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649
cvssv3.1 8.1 https://web.archive.org/web/20210125001406/https://www.securityfocus.com/bid/106877
generic_textual HIGH https://web.archive.org/web/20210125001406/https://www.securityfocus.com/bid/106877
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-0649
https://github.com/chakra-core/ChakraCore
https://github.com/chakra-core/ChakraCore/commit/beba75a1aed0933cf3c76efb4dc67529dc035901
https://github.com/chakra-core/ChakraCore/pull/5936
https://web.archive.org/web/20210125001406/https://www.securityfocus.com/bid/106877
http://www.securityfocus.com/bid/106877
CVE-2019-0649 https://nvd.nist.gov/vuln/detail/CVE-2019-0649
CVE-2019-0649 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/chakra-core/ChakraCore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/chakra-core/ChakraCore/commit/beba75a1aed0933cf3c76efb4dc67529dc035901
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/chakra-core/ChakraCore/pull/5936
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-0649
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20210125001406/https://www.securityfocus.com/bid/106877
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.93003
EPSS Score 0.09543
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:38:58.249781+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/Microsoft.ChakraCore/CVE-2019-0649.yml 38.6.0