Use After Free Affecting hermes-engine package, versions <0.7.0
Threat Intelligence
EPSS
0.36% (73rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-HERMESENGINE-1309667
- published 16 Jun 2021
- disclosed 16 Jun 2021
- credit Unknown
Introduced: 16 Jun 2021
CVE-2021-24037 Open this link in a new tabHow to fix?
Upgrade hermes-engine to version 0.7.0 or higher.
Overview
hermes-engine is an A JavaScript engine optimized for running React Native on Android
Affected versions of this package are vulnerable to Use After Free. While emitting certain error messages, attackers could potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
References
CVSS Scores
version 3.1