Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/413938?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/413938?format=api", "purl": "pkg:apk/alpine/hermes@0?arch=s390x&distroversion=edge&reponame=community", "type": "apk", "namespace": "alpine", "name": "hermes", "version": "0", "qualifiers": { "arch": "s390x", "distroversion": "edge", "reponame": "community" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/111455?format=api", "vulnerability_id": "VCID-3sx3-tkjz-6qeh", "summary": "Always-Incorrect Control Flow Implementation in Facebook Hermes\nA logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1914", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.80771", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.80813", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.80793", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.80797", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.808", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.01402", "scoring_system": "epss", "scoring_elements": "0.80798", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1914" }, { "reference_url": "https://github.com/facebook/hermes", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes" }, { "reference_url": "https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc" }, { "reference_url": "https://github.com/facebook/hermes/issues/373", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes/issues/373" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1914", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1914" }, { "reference_url": "https://www.facebook.com/security/advisories/cve-2020-1914", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.facebook.com/security/advisories/cve-2020-1914" }, { "reference_url": "https://github.com/advisories/GHSA-327c-qx3v-h673", "reference_id": "GHSA-327c-qx3v-h673", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-327c-qx3v-h673" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/413938?format=api", "purl": "pkg:apk/alpine/hermes@0?arch=s390x&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/hermes@0%3Farch=s390x&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2020-1914", "GHSA-327c-qx3v-h673" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3sx3-tkjz-6qeh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/111294?format=api", "vulnerability_id": "VCID-mkuc-ejs9-kfdr", "summary": "Out-of-bounds Read in Facebook Hermes\nAn out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1915", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.7833", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.78326", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.78309", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.7832", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.78296", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.01092", "scoring_system": "epss", "scoring_elements": "0.78322", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1915" }, { "reference_url": "https://github.com/facebook/hermes", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes" }, { "reference_url": "https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0" }, { "reference_url": "https://github.com/facebook/hermes/issues/373", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/facebook/hermes/issues/373" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1915", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1915" }, { "reference_url": "https://www.facebook.com/security/advisories/cve-2020-1915", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.facebook.com/security/advisories/cve-2020-1915" }, { "reference_url": "https://github.com/advisories/GHSA-x4cf-6jr3-3qvp", "reference_id": "GHSA-x4cf-6jr3-3qvp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x4cf-6jr3-3qvp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/413938?format=api", "purl": "pkg:apk/alpine/hermes@0?arch=s390x&distroversion=edge&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/hermes@0%3Farch=s390x&distroversion=edge&reponame=community" } ], "aliases": [ "CVE-2020-1915", "GHSA-x4cf-6jr3-3qvp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mkuc-ejs9-kfdr" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/hermes@0%3Farch=s390x&distroversion=edge&reponame=community" }