CVE-2026-88390

An out-of-bounds write vulnerability in jslGetTokenValueAsString in Espruino 2v29 commit bffc6d0 allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NOASSERT builds. The out-of-bounds write corrupts the adjacent...

CVE-2026-88390

Espruino 2v29 (commit bffc6d0) is vulnerable to an out-of-bounds write within the jslGetTokenValueAsString() function. This flaw occurs when crafted JavaScript input containing an overlong token triggers a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The write corrupt...