CVE-2022-1212

Published: Apr 5, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

Affected (3)

Products: Mruby: Mruby

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mruby Mruby	Up to 3.0.0
Mruby Mruby	Version 3.1.0 rc2
Mruby Mruby	Version 3.1.0 rc

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (4)

https://github.com/mruby/mruby/commit/3cf291f72224715942beaf8553e42ba8891ab3c6

Source: security@huntr.dev

PatchThird Party Advisory

https://huntr.dev/bounties/9fcc06d0-08e4-49c8-afda-2cae40946abe

Source: security@huntr.dev

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/mruby/mruby/commit/3cf291f72224715942beaf8553e42ba8891ab3c6

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://huntr.dev/bounties/9fcc06d0-08e4-49c8-afda-2cae40946abe

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.