Approved changes feed: RSS · Atom
cpe:2.3:a:facebook:hermes:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Facebook (c319c35a-3469-5baa-b3bd-8582d1206a92) |
|---|---|
| Product | Hermes (e0e95d03-34e5-5a1a-b1eb-60c308274f0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/facebook/hermes |
purl2cpe | 2026-06-01 10:11:43.225340 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-30470 |
vulnerable | 2026-06-08 06:04:39.605579 |
Details available
A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18T21:27:57.350Z
Updated: 2025-01-21T20:09:25.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28081 |
vulnerable | 2026-06-08 06:01:09.501510 |
Details available
A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18T21:26:49.822Z
Updated: 2025-01-21T20:16:02.965Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25933 |
vulnerable | 2026-06-08 05:56:10.809923 |
Details available
A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18T21:24:58.365Z
Updated: 2025-01-21T20:20:00.366Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24833 |
vulnerable | 2026-06-08 05:56:06.296006 |
Details available
A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18T21:24:11.057Z
Updated: 2025-01-21T20:21:32.835Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24832 |
vulnerable | 2026-06-08 05:56:06.295640 |
Details available
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18T21:24:01.747Z
Updated: 2025-01-21T20:23:54.785Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23557 |
vulnerable | 2026-06-08 05:56:03.005341 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23556 |
vulnerable | 2026-06-08 05:56:03.004938 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40138 |
vulnerable | 2026-06-08 05:48:24.030854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-35289 |
vulnerable | 2026-06-08 05:46:04.533721 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32234 |
vulnerable | 2026-06-08 05:44:43.046652 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-27810 |
vulnerable | 2026-06-08 05:42:43.356354 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-27810 |
not_vulnerable | 2026-06-08 05:42:43.356303 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24045 |
vulnerable | 2026-06-08 05:30:03.539526 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24045 |
not_vulnerable | 2026-06-08 05:30:03.539493 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24044 |
vulnerable | 2026-06-08 05:30:03.539175 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24044 |
not_vulnerable | 2026-06-08 05:30:03.539122 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24037 |
vulnerable | 2026-06-08 05:30:03.523553 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1915 |
vulnerable | 2026-06-08 05:21:03.511688 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1914 |
vulnerable | 2026-06-08 05:21:03.511313 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1913 |
vulnerable | 2026-06-08 05:21:03.511020 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1912 |
vulnerable | 2026-06-08 05:21:03.510719 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1911 |
vulnerable | 2026-06-08 05:21:03.510403 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1896 |
vulnerable | 2026-06-08 05:21:03.483840 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.