CVE-2020-1914

highpriority · track · 40EPSS 0.025 · 85 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.51% (85th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-22

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-670USprimaryCWE-1119USCWE-670US

affected products (3)

Products and version ranges known to be affected.

Facebook Hermes≤ commit prior to b2021df620824627f5a8c96615edbd1eb7fdddfcenisa_euvdEU
facebook hermes< 2020-10-01nvdUScpe:2.3:a:facebook:hermes:*:*:*:*:*:*:*:*
npm hermes-engine< 0.7.2osvUSpkg:npm/hermes-engine

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-327c-qx3v-h673Always-Incorrect Control Flow Implementation in Facebook Hermes2022-05-24ghsa · osvUS
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2020-10-08modified 2026-06-17

related (561)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-32896US	high7.8OT critical	2.99% (87th)	KEV	2024-06-13
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2020-28052US	high8.1	7.22% (94th)	Exploit	2020-12-18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, all…
CVE-2023-0400US	high8.2	0.42% (35th)	Exploit	2023-02-02
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from…
CVE-2026-35414US	high8.1	0.24% (15th)	Exploit	2026-04-02
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certai…
CVE-2026-38361US	high7.5	2.78% (86th)	Exploit	2026-05-08
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_upl…

+556 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan