CVE-2026-88389

Espruino 2v29 (commit bffc6d0 ) is susceptible to a NULL pointer dereference vulnerability within the jslGetRawString() function in src/jslex.c. Processing crafted raw or binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the abs...

CVE-2026-88389: NULL Pointer Dereference

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

PT-2026-98861

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 Description A NULL pointer dereference occurs in the jslGetRawString function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the...

CVE-2026-88389

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...