Out-of-Bounds Affecting hermes-engine package, versions <0.7.0
Threat Intelligence
EPSS
0.7% (81st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-HERMESENGINE-629748
- published 10 Sep 2020
- disclosed 10 Sep 2020
- credit Unknown
Introduced: 10 Sep 2020
CVE-2020-1912 Open this link in a new tabHow to fix?
Upgrade hermes-engine to version 0.7.0 or higher.
Overview
hermes-engine is an A JavaScript engine optimized for running React Native on Android
Affected versions of this package are vulnerable to Out-of-Bounds. An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
References
CVSS Scores
version 3.1