CVE-2021-24044
Critical
Description
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
SeverityCritical
CVSS9.8
Exploit probability70. percentile1.3%
Product
Facebook Hermes
PublishedJan 15, 2022
First seenJan 15, 2022
Weakness typeCWE-843CWE-843
How to fix
Update
- facebook hermes0.10.0 or later
- hermes-engine0.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facebook hermes | v < 0.10.0 | 0.10.0 |
| hermes-enginenpm | v < 0.10.0 | 0.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.