Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-33449: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.

CVE-2021-33449 · published 4 years ago

Summary

An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.

What to do

Update cesanta mjs to version 2.20.0 or later.

Affected software

Vendor	Product	Affected versions
cesanta	mjs	< 2.20.0 `cpe:2.3:a:cesanta:mjs::::::::`

Original advisory text

An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.

References

https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d Third Party Advisory
https://github.com/cesanta/mjs/issues/162 Exploit Issue Tracking Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published26 Jul 2022

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2021-33449 · NVD

Track software like this

Free during beta