CVE-2021-46339

What it actually does

Invalid CESU-8 string input triggers an assertion failure inside ecma_new_ecma_string_from_utf8, terminating the JerryScript engine process.

Why it matters to the business

Applications embedding JerryScript become unavailable after processing a single malicious input, interrupting any service or device that depends on the engine.

How an attack unfolds

An attacker crafts a file or data stream containing a malformed CESU-8 sequence, then causes the target application to load or evaluate that data, triggering the assertion and crashing the engine.

How to fix it

Upgrade JerryScript to a version containing a corrected string-validation routine; until a patch is available, sanitize or reject untrusted input before it reaches ecma_new_ecma_string_from_utf8.

How to confirm the fix worked

Re-run the engine against the original crashing input after applying the fix and confirm the assertion no longer fires; monitor process exit codes and logs for the former failure path.

Typical attack path

1. Identify an application or device that embeds JerryScript 3.0.0
2. Prepare a data blob containing an invalid CESU-8 byte sequence
3. Deliver the blob via local file, command-line argument, or UI interaction
4. Trigger script parsing or string creation inside the engine
5. Observe process termination due to the failed assertion

How to detect it

Search application and system logs for segmentation faults or abort signals originating from ecma-helpers-string.c; correlate with recent file or data ingestion events that involve JavaScript string handling.

What your security team should do

• Inventory all products and firmware that ship JerryScript 3.0.0
• Prioritize patching or replacing affected components because an exploit is already public
• Implement input sanitization layers around any JavaScript evaluation entry points
• Add crash-monitoring alerts for the ecma-helpers-string assertion pattern