PT-2023-21541 · Hermes · Hermes

Published 2023-05-18 · Updated 2025-01-21 · CVE-2023-28081

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81

Description A bytecode optimization bug could be used to cause a use-after-free and obtain arbitrary code execution via a carefully crafted payload. This is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Most React Native applications are not affected.

Recommendations For versions prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81, update to a version that includes the fix for the bytecode optimization bug. As a temporary workaround, consider restricting the execution of untrusted JavaScript in Hermes until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2023-28081

Affected Products

Hermes

References · 7

• https://github.com/facebook/hermes/commit/e6ed9c1a4b02dc219de1648f44cd808a56171b81 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28081 · Security Note
• https://facebook.com/security/advisories/cve-2023-28081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28081 · Vendor Advisory
• https://t.me/cvenotify/108144 · Telegram Post
• https://t.me/cvenotify/50772 · Telegram Post
• https://t.me/cibsecurity/64440 · Telegram Post