CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-24044
Critical (9.8) in facebook hermes. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in hermes-engine 0.10.0.
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-843
- Published
- Modified
- Record from
- the NVD, synced
Affected
- facebook:hermes
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7mhc-prgv-r3q4 | npm | hermes-engine | <0.10.0 | 0.10.0 |