CVE-2020-1911

Katalog CVE

CVSS 9.8 · Critical EPSS 2,0%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada facebook hermes. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Rincian

Terbit di NVD

4 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facebook/hermes/commit/fe52854cdf6725c2eaa9e125995da76e6ceb27da patch · advisory pihak ketiga
• https://www.facebook.com/security/advisories/cve-2020-1911 advisory pihak ketiga