CVE-2022-27810

2022-10-0600:00:00

CWE-674

facebook

www.cve.org

hermes

recursion

error-handler

EPSS

0.001

Percentile

38.4%

JSON

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.

CNA Affected

[
  {
    "vendor": "Facebook",
    "product": "Hermes",
    "versions": [
      {
        "version": "0.12.0",
        "status": "unaffected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "0.12.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.facebook.com/security/advisories/cve-2022-27810

EPSS

0.001

Percentile

38.4%

JSON

Related for CVELIST:CVE-2022-27810