VULNERABILITY INTELLIGENCE

CVE-2021-24044

CVSS score9.8 CRITICAL
EPSS probability1.26%
CISA KEVNot currently listed
Published2022-01-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.

Weakness classification

  • cve-assign@fb.com: CWE-843
  • nvd@nist.gov: CWE-843

Primary references