CVE-2021-44993

What it actually does

Assertion failure in ecma-get-put-value.c causes immediate process crash on certain local inputs, resulting in denial of service.

Why it matters to the business

Applications or services embedding this JavaScript engine can be forced offline by a local user, interrupting operations with no data loss but requiring restart; the flaw remains unpatched in listed versions and has publicly available exploits despite low exploitation probability.

How an attack unfolds

An attacker supplies crafted input to a Jerryscript-based application that reaches the failing assertion path during value handling, triggering an immediate crash. Public exploit code exists and has been available since shortly after disclosure.

How to fix it

Upgrade to a newer Jerryscript release that resolves the assertion failure; if no fixed version is available, isolate affected components or implement input sanitization to prevent triggering the code path.

How to confirm the fix worked

Test the application with known triggering inputs in a controlled environment and monitor for the specific assertion failure message in logs or core dumps; retest after any engine update.

Typical attack path

1. Identify a target process or service using the vulnerable Jerryscript engine
2. Craft or obtain input that violates the ecma_is_value_boolean assertion
3. Deliver the input locally to trigger the crash
4. Confirm service interruption and repeat as needed

How to detect it

Review application and system logs for the assertion failure string, unexpected process terminations, or core dumps referencing ecma-get-put-value.c; correlate with user activity that supplies JavaScript or data to the engine.

• ecma_is_value_boolean (base_value) failed
• /jerry-core/ecma/operations/ecma-get-put-value.c

What your security team should do

• Prioritize removal or isolation of Jerryscript 3.0.0 deployments given the public exploit and long disclosure window
• Scan all codebases and containers for the affected engine version
• Implement runtime monitoring for process crashes matching the assertion location
• Plan migration to a maintained fork or alternative engine if upstream fixes remain unavailable