Security readout for executives and security teams
Plain-English summary
CVE-2021-33444 is a NULL pointer dereference in the mJS restricted JavaScript engine. It may let malformed JavaScript crash software that embeds mJS. The public record does not provide CVSS, affected versions, or a vendor fix, so urgency depends on whether your systems run mJS against untrusted scripts.
Executive priority
Treat this as an inventory-driven risk, not a confirmed emergency. Prioritize quickly if mJS is embedded in exposed products, customer-facing services, or safety-critical devices. Current public data is too incomplete to assign a confident severity.
Technical view
The issue is reported in getprop_builtin_foreign() in mjs.c when handling ES6 JavaScript in mJS. The available sources identify a NULL pointer dereference, but do not document exact affected versions, impact scope, or remediation status. Expected impact is likely stability loss or denial of service in affected embedding applications.
Likely exposure
Exposure is most likely in embedded, IoT, or application components that include the Cesanta mJS engine and process user-controlled or externally supplied JavaScript. The source bundle lists no precise affected versions or CPEs, so exposure requires software inventory and dependency review.
Exploitation context
The CVE is not listed as CISA KEV in the supplied data. Public references include a GitHub issue and a gist, indicating public technical discussion, but the bundle does not prove active exploitation or widespread weaponization.
Researcher notes
Key gaps are missing CVSS, affected version ranges, CPEs, and confirmed fix information. Analysis should focus on identifying mJS usage, comparing local mjs.c against upstream changes, and assessing whether attacker-controlled scripts can reach getprop_builtin_foreign().
Mitigation direction
- Check whether any product or firmware embeds Cesanta mJS.
- Review vendor or maintainer guidance for patched mJS revisions.
- Reduce or disable untrusted JavaScript execution where feasible.
- Isolate services that execute mJS from critical systems.
- Monitor affected applications for unexpected crashes or restarts.
Validation and detection
- Search software bills of materials for mJS or Cesanta mjs.
- Review embedded firmware and third-party components for mjs.c.
- Confirm whether JavaScript input can be supplied by users or remote systems.
- Check maintainer release notes or commits for getprop_builtin_foreign() fixes.
- Verify crash monitoring covers applications embedding mJS.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33444 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/cesanta/mjs/issues/166CVE reference · x_refsource_MISC
- https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.