diff --git a/chakracore-git/TODO b/chakracore-git/TODO
new file mode 100644
index 0000000000..18c3f3f1cd
--- /dev/null
+++ b/chakracore-git/TODO
@@ -0,0 +1,2 @@
+This package has known vulnerabilities, please investigate and fix if possible:
+CVE-2020-1057, CVE-2020-1180, CVE-2020-1172