CVE-2021-46347

What it actually does

Malformed input triggers an assertion failure in ecma_object_check_class_name_is_object during object class validation, causing an immediate process abort.

Why it matters to the business

Applications or services embedding the engine experience sudden crashes and loss of availability when processing attacker-controlled or untrusted scripts.

How an attack unfolds

An attacker supplies a specially crafted script or data object that reaches the failing assertion path; because an exploit is publicly available, the input can be delivered via local file, command-line argument, or embedded script execution to force a denial-of-service condition.

How to fix it

Upgrade to a maintained version of JerryScript that removes the assertion or adds proper error handling for invalid objects; where an upgrade is unavailable, isolate or sandbox any JerryScript execution and reject untrusted input before it reaches the engine.

How to confirm the fix worked

Replay the crashing input in a controlled environment and confirm the process no longer aborts with the original assertion message; monitor for graceful error returns instead of crashes.

Typical attack path

1. Identify a target process or application that embeds JerryScript 3.0.0
2. Prepare or obtain a minimal JavaScript snippet that violates the expected object class invariant
3. Cause the target to evaluate or parse the malicious input (local execution, file open, or API call)
4. Trigger the assertion failure resulting in immediate process termination

How to detect it

Search application and system logs for the exact assertion failure string, unexpected process exits, or core dumps originating from jerry-core/ecma/operations/ecma-objects.c around the time of suspected attacks.

• ecma_object_check_class_name_is_object (obj_p)
• /jerry-core/ecma/operations/ecma-objects.c
• Assertion.*failed.*jerry

What your security team should do

• Treat the issue as a high-priority availability risk given the public exploit
• Inventory all products and services that embed JerryScript and schedule upgrades or replacements
• Implement input sanitization or sandboxing around any remaining instances until fixed
• Add crash-monitoring alerts for the assertion string in application logs