Out-of-Bounds Affecting hermes-engine Open this link in a new tab package, versions <0.7.0


0.0
medium
  • Attack Complexity

    High

  • Privileges Required

    High

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JS-HERMESENGINE-629748

  • published

    10 Sep 2020

  • disclosed

    10 Sep 2020

  • credit

    Unknown

How to fix?

Upgrade hermes-engine to version 0.7.0 or higher.

Overview

hermes-engine is an A JavaScript engine optimized for running React Native on Android

Affected versions of this package are vulnerable to Out-of-Bounds. An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.