What is GHSA-pp3g-9mvp-c3vm?

GHSA-pp3g-9mvp-c3vm is a security advisory published by GitHub Security Advisories with Medium severity. Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in...

Which CVE IDs does GHSA-pp3g-9mvp-c3vm cover?

GHSA-pp3g-9mvp-c3vm covers the following CVE IDs: CVE-2026-88389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pp3g-9mvp-c3vm?

GHSA-pp3g-9mvp-c3vm has a CVSS v3 base score of 6.2, published by GitHub Security Advisories.

GHSA-pp3g-9mvp-c3vmMediumCVSS 6.2

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in...

Vendor

GitHub Security Advisories

Published

September 25, 2026

Last Modified

September 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-88389 →

📋 Description

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(). In RELEASE/NO_ASSERT builds, the missing assertion guard allows a write through the NULL pointer, resulting in memory corruption and application termination or denial of service.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-88389
https://github.com/espruino/Espruino/issues/2745
https://github.com/espruino/Espruino/commit/0db0663ac5201a6fea68094b45da673edec45187
https://github.com/advisories/GHSA-pp3g-9mvp-c3vm