Quick answers
- Is CVE-2026-88390 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88390 being exploited in the wild.
- How severe is CVE-2026-88390?
- High severity, with a CVSS score of 7.7, published 24 September 2026.
- Which products and versions are affected?
- Espruino 2v29 (commit bffc6d0).
- Is there a fix for CVE-2026-88390?
- A patch was published on 2026-09-24: Fix available in commit ecd7d43 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88390 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-88390?
- Check whether you run Espruino at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds write in jslGetTokenValueAsString() occurs when a token is ≥64 bytes: jsvGetString fills the 64-byte JsLex.token buffer and returns 64, but the guard assert(tokenl < 64) is compiled out in RELEASE/-DNO_ASSERT builds, allowing the unconditional token[tokenl]=0 assignment to write one byte past the buffer into the adjacent tokenValue pointer. The vulnerability requires supplying crafted malformed JavaScript with an overlong token on the lexer error path and is exploitable via network or local JavaScript execution.
Affected products
- Espruino Espruino 2v29 (commit bffc6d0)
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Fix available in commit ecd7d43