CVE-2023-23557

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235586.3In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver CVE-2023-235597.8In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.CVE-2023-23567.5Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.CVE-2023-235609.8In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.CVE-2023-235615.5Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.CVE-2023-235624.3Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameter CVE-2023-235636.5An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to obtain sensitive database content via SQL Injec CVE-2023-235648.8An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands.CVE-2023-235654.9An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local Fi CVE-2023-235669.8A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to a CVE-2023-235678.8A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A specially crafted fil CVE-2023-235685.4Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields.