Critical · published May 18, 2023
🚨 An out-of-bounds write in Hermes could let attackers execute arbitrary code — think of it as a sneaky hacker slipping a note into the wrong mailbox and taking over your entire letter collection! 🔥 This vulnerability is like a careless delivery driver who misreads the address and drops off a package at the wrong house. Instead of just leaving it on the porch, they let themselves in and start rearranging your furniture! An attacker could exploit this flaw to run any code they want within the context of your application, potentially accessing sensitive data or manipulating critical code. It's a critical risk, especially if your app executes untrusted JavaScript — yikes!
This vulnerability is like a careless delivery driver who misreads the address and drops off a package at the wrong house. Instead of just leaving it on the porch, they let themselves in and start rearranging your furniture! The error in BigInt conversion to Number in Hermes allows out-of-bound writes, which can lead to arbitrary code execution when executing untrusted JavaScript. This makes it possible for an attacker to manipulate the execution flow of the application.
An attacker could exploit this flaw to run any code they want within the context of your application, potentially accessing sensitive data or manipulating critical code. It's a critical risk, especially if your app executes untrusted JavaScript — yikes! Update Hermes to the latest version past commit a6dcafe6ded8e61658b40f5699878cd19a481f80 to fix this vulnerability. Review your application to ensure no untrusted JavaScript is executed without proper validation. You've got this! By taking these steps, you'll be securing your app like a pro! 🛡️