CVE-2021-46350

What it actually does

The flaw triggers an assertion failure 'ecma_is_value_object (value)' in jerry-core/ecma/base/ecma-helpers-value.c when processing crafted ECMAScript input, causing an immediate process crash and denial of service.

Why it matters to the business

Applications embedding JerryScript become unavailable when fed malicious input, resulting in service outages, potential loss of in-memory state, and operational disruption until the process is restarted.

How an attack unfolds

An attacker supplies specially crafted JavaScript to the JerryScript engine; the input reaches the ecma-helpers-value path and violates the object-type assertion, terminating the process. Public exploit code is available to automate delivery of the crashing payload.

How to fix it

Upgrade to a JerryScript build that removes or guards the failing assertion and handles the value safely; if no patched release exists, isolate the engine from untrusted input or replace it with a maintained alternative.

How to confirm the fix worked

Run the engine against known crashing test cases in a controlled environment and confirm absence of the assertion abort; monitor process stability under load with the same inputs.

Typical attack path

1. Identify an application or service that embeds the vulnerable JerryScript engine and accepts untrusted scripts or data
2. Craft or obtain input that violates the ecma_is_value_object assertion
3. Deliver the input locally to the target process (file, stdin, or API call)
4. Trigger execution so the assertion is evaluated, causing immediate crash
5. Repeat or automate to sustain denial of service

How to detect it

Review application and system logs for abrupt process exits, segmentation faults, or messages referencing ecma-helpers-value.c or the failed assertion; correlate with recent file or input activity involving JavaScript content.

What your security team should do

• Prioritize removal of untrusted script execution or sandbox the JerryScript process with strict resource limits
• Inventory all products and services using JerryScript 3.0.0 and schedule upgrades or replacement
• Add runtime monitoring for unexpected process terminations and alert on assertion-related crashes
• Disable or restrict local execution paths that accept external ECMAScript until fixed