CVE-2021-46343

What it actually does

The vulnerability triggers an assertion failure 'context_p->token.type == LEXER_LITERAL' in the JavaScript expression parser at js-parser-expr.c, causing the JerryScript engine to abort when processing certain inputs.

Why it matters to the business

Applications or embedded systems using JerryScript may crash when handling untrusted or malformed JavaScript, resulting in denial of service and operational downtime.

How an attack unfolds

An attacker supplies a specially crafted JavaScript snippet that violates the parser's token type assumption during expression parsing; when the victim application processes the input locally with user interaction, the assertion fails and the process terminates.

How to fix it

Upgrade JerryScript to a version that resolves the parser assertion issue once released; in the interim, avoid processing untrusted JavaScript, implement strict input sanitization, and run the engine under resource limits or sandboxing.

How to confirm the fix worked

Confirm JerryScript version is updated, then test parsing of known assertion-triggering inputs in a controlled environment to verify absence of crashes and assertion failures.

Typical attack path

1. Create malicious JavaScript input designed to fail the lexer literal token check in the expression parser.
2. Deliver the input file or payload to a target system running an affected JerryScript version.
3. Trigger local parsing of the input via the affected application to induce the assertion failure and crash.

How to detect it

Review application and system logs for assertion failure messages referencing js-parser-expr.c or LEXER_LITERAL, unexpected process terminations of jerryscript binaries, or crash dumps containing parser expression context.

• Assertion 'context_p->token.type == LEXER_LITERAL' failed at /jerry-core/parser/js/js-parser-expr.c
• jerry-core/parser/js/js-parser-expr.c

What your security team should do

• Inventory all deployments of JerryScript and assess exposure to untrusted inputs.
• Prioritize upgrades as soon as fixed versions become available.
• Apply compensating controls such as input validation and process isolation until patched.
• Monitor project releases and security advisories for JerryScript updates.