CVE-2022-27810

2022-10-0620:15:17

Google

osv.dev

hermes

infinite recursion

vulnerability

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

38.4%

JSON

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.

References

www.facebook.com/security/advisories/cve-2022-27810