CVE-2023-36109

CRITICAL

JerryScript 3.0 - RCE

Title source: llm

Description

Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_raw component at /jerry-core/ecma/base/ecma-helpers-string.c.

Exploits (1)

nomisec WORKING POC 2 stars

by Limesss · poc

https://github.com/Limesss/CVE-2023-36109

View Code ZIP pw:eip

References (2)

[Exploit] https://github.com/Limesss/CVE-2023-36109/tree/main

[Exploit, Issue Tracking] https://github.com/jerryscript-project/jerryscript/issues/5080

Scores

CVSS v3 9.8

EPSS 0.2036

EPSS Percentile 95.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-120

Status published

Products (1)

jerryscript/jerryscript 3.0

Published Sep 20, 2023

Tracked Since Feb 18, 2026