GitHub Advisoryadvisory · npm

GHSA-gmpm-xp43-f7g6 Signed to Unsigned Conversion Error in Facebook Hermes

HIGH Published 2022-05-24 Modified 2022-06-24 Official page ↗
Aliases
CVE-2020-1913
Ecosystem
npm
Packages
hermes-engine
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-195, CWE-681
Reviewed
2022-06-24

Affected packages

• npm hermes-engine: < 0.5.2 → fixed in 0.5.2

Description

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Related

Alias · CVE (1)

  • CVE-2020-1913 An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6… vulnerability

Weakness · CWE (2)

  • CWE-195 Signed to Unsigned Conversion Error weakness
  • CWE-681 Incorrect Conversion between Numeric Types weakness

References