EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-88389

The Espruino 2v29 (commit bffc6d0) software contains a NULL pointer dereference vulnerability within the jslGetRawString() function located in src/jslex.c . When processing crafted raw/binary string input, the lexer may pass a NULL iterator target to jsvLockAgain() . In RELEASE/NO_ASSERT builds, ...