Security readout for executives and security teams
Plain-English summary
CVE-2023-36201 is an information disclosure issue in JerryScript v3.0.0. A specially crafted script involving arrays may let an attacker read sensitive information. Public source data does not provide a CVSS score, fixed version, or evidence of active exploitation.
Executive priority
Prioritize scoping before emergency action. The issue may matter where JerryScript processes untrusted code, but public evidence is sparse and exploitation is not confirmed. Assign ownership to inventory embedded runtime use and track vendor remediation.
Technical view
The CVE describes a CWE-125 out-of-bounds read in JerryscriptProject JerryScript v3.0.0, triggered through crafted array script behavior. The record lists the affected product fields as incomplete and points to a GitHub issue for detail. No official remediation details are included in the supplied sources.
Likely exposure
Exposure is likely limited to software that embeds or runs JerryScript v3.0.0, especially where users or external systems can supply JavaScript. The source bundle does not identify CPEs, downstream products, or affected deployment patterns.
Exploitation context
The supplied sources support a crafted-script information disclosure condition. They do not show CISA KEV listing, known exploitation in the wild, public exploit maturity, or weaponized use. Treat exploit status as unconfirmed.
Researcher notes
Key gaps: no CVSS vector, no CPEs, no named fixed version, and no KEV signal. The CWE-125 classification suggests memory read exposure, but validation should stay focused on version presence and script reachability, not exploit development.
Mitigation direction
- Inventory products or firmware embedding JerryScript v3.0.0.
- Check upstream JerryScript guidance for fixed versions or patches.
- Avoid running untrusted scripts in affected runtimes until remediated.
- Reduce script privileges and isolate affected execution environments.
- Monitor the referenced GitHub issue and CVE record for updates.
Validation and detection
- Search dependency manifests and source trees for JerryScript v3.0.0.
- Confirm whether untrusted JavaScript can reach the affected runtime.
- Review vendor advisories for any fixed JerryScript release reference.
- Document affected assets and business processes using the runtime.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-36201 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/jerryscript-project/jerryscript/issues/5026CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.