CVE-2023-30470 is a critical use-after-free vulnerability in Facebook Hermes, specifically affecting bytecode generation when optimizations are enabled prior to commit da8990f737ebb9d9810633502f65ed462b819c09. This flaw carries a CVSS score of 9.8 (CRITICAL) due to its potential for unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, though it primarily affects scenarios where Hermes executes untrusted JavaScript. There is no evidence of active exploitation, nor are there public exploit modules in Metasploit, Nuclei, or ExploitDB, despite significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:facebook:hermes:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.