CVE-2020-1914

Name of the Vulnerable Software and Affected Versions Facebook Hermes versions prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc

Description A logic issue in handling the SaveGeneratorLong instruction allows attackers to potentially read out of bounds or execute arbitrary code via crafted JavaScript, but only if the application permits evaluation of untrusted JavaScript.

Recommendations For Facebook Hermes versions prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the evaluation of untrusted JavaScript in applications using Hermes to minimize the risk of exploitation.