CVE-2021-46340

What it actually does

Assertion failure in JerryScript parser at js-scanner.c during statement scanning causes immediate process crash when processing certain JavaScript input.

Why it matters to the business

Applications embedding JerryScript can be forced offline by untrusted scripts, interrupting services that rely on the engine for execution.

How an attack unfolds

An attacker supplies a malicious JavaScript file or snippet that reaches the scanner's statement-end logic, triggering the failing assertion and terminating the process. Public exploit code is available to automate the crash.

How to fix it

Upgrade to a patched JerryScript release once available; in the interim, isolate the engine from untrusted input or wrap it in a crash-resilient supervisor process.

How to confirm the fix worked

Replay the known crashing JavaScript snippet against the updated binary and confirm the assertion no longer fires and the process remains stable.

Typical attack path

1. Identify an application or service that embeds JerryScript and accepts external JavaScript
2. Craft input that ends a try or catch statement in a way that violates the scanner stack check
3. Deliver the input through the application's normal script ingestion path
4. Observe process termination and service unavailability

How to detect it

Review application and system logs for unexpected JerryScript process terminations or assertion failures around the js-scanner module when processing external scripts.

What your security team should do

• Inventory all deployments that embed JerryScript and mark them for priority patching
• Apply runtime sandboxing or process restart policies around the engine until a fix is deployed
• Monitor upstream JerryScript commits for the scanner assertion fix and test the resulting build