CVE-2023-28081

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-280835.4A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integ CVE-2023-280845.5HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens CVE-2023-280855.5An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials CVE-2023-280865.5An HPE OneView appliance dump may expose proxy credential settings CVE-2023-280875.5An HPE OneView appliance dump may expose OneView user accounts CVE-2023-280887.8An HPE OneView appliance dump may expose SAN switch administrative credentials CVE-2023-280897.1An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules CVE-2023-28099.8Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to e CVE-2023-280905.5An HPE OneView appliance dump may expose SNMPv3 read credentials CVE-2023-280915.5HPE OneView virtual appliance "Migrate server hardware" option may expose sensitive information in an HPE OneView support dump CVE-2023-280926.8A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system bein CVE-2023-280936.5A user with a compromised configuration can start an unsigned binary as a service.