CVE-2026-88389

Name of the Vulnerable Software and Affected Versions Espruino version 2v29

Description A NULL pointer dereference occurs in the jslGetRawString() function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the jsvLockAgain() function. In RELEASE/NO ASSERT builds, the absence of an assertion guard allows a write operation through the NULL pointer, leading to memory corruption, application termination, or a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.