CVE-2021-24045

State: Published
Severity: Not scored
Published: Dec 13, 2021
Updated: Aug 3, 2024
Reserved: Jan 13, 2021

Description

A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Scores

The record has no CVSS score.

Weaknesses

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Affected Products

Product	Versions
HermesFacebook	0.10.0 to before unspecifiedNot affected before 0.10.0Affected

References

https://www.facebook.com/security/advisories/cve-2021-24045
https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.