-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper instruction pointer handling in the interpreter loop for SaveGeneratorLong. The pre-patch code used a shared code path (doSaveGen) that set 'ip = NEXTINST(SaveGenerator)' regardless of whether the original instruction was SaveGenerator or SaveGeneratorLong. This failed to account for the longer instruction format, causing incorrect IP calculation. The patch specifically addresses this by using NEXTINST with the correct instruction type for each case.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hermes-engine | npm | <= 0.7.1 | 0.7.2 |