Type Confusion Vulnerability in Facebook Hermes JavaScript Engine
CVE-2020-1911

9.8CRITICAL

Key Information:

Vendor

Facebook

Status
Hermes
Vendor
CVE Published:
4 September 2020

What is CVE-2020-1911?

A type confusion vulnerability exists in the Facebook Hermes JavaScript engine, specifically affecting its ability to properly resolve properties of JavaScript objects with specially-crafted prototype chains. This flaw allows attackers to potentially execute arbitrary code if the application that integrates Hermes permits the evaluation of untrusted JavaScript. It is crucial to note that most React Native applications that use Hermes are not affected due to their default security practices.

Affected Version(s)

Hermes commit prior to fe52854cdf6725c2eaa9e125995da76e6ceb27da

References

https://www.facebook.com/security/advisories/cve-2020-1911
x_refsource_CONFIRM
https://github.com/facebook/hermes/commit/fe52854cdf6725c...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.