CVE-2021-46544

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.15.5Medium EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2022-01-27Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Ask your IT provider whether any system uses MJS v2.20.0.
Check the vendor’s remediation guidance for an available update; no fixed version is published in the findings.
Until updated, restrict untrusted local users from running or supplying content to affected MJS-based tools.
Investigate repeated application crashes on systems using MJS.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service (DoS).

In plain language

Written by AI from the record

MJS v2.20.0 can be crashed by a local attacker, so small businesses using it should have their software provider check it and obtain the vendor’s remediation.

MJS v2.20.0 has a locally triggered segmentation-fault condition that can cause denial of service after user interaction.

If you're affected

Application crashes
Service interruption
Lost processing time

What is it

This flaw can make an MJS-based program suddenly stop working. It is like someone being able to jam a small machine so it shuts down, interrupting the work it was doing without giving them access to its contents.

Who is affected

This matters to you if you run software that includes MJS. It is only a risk when an attacker can act on the affected computer and induce a user interaction.

How urgent is it

A public proof-of-concept exists, so treat this as a meaningful stability risk and have the affected software reviewed promptly. It is not listed in CISA’s catalog of vulnerabilities known to be actively exploited, which supports an amber—not emergency—response.

What to do — in detail

Confirm whether MJS v2.20.0 is present in deployed applications, including bundled or embedded copies, and identify which users can run or feed input to those applications.

The findings do not provide a fixed version or supported release branch. Follow the vendor’s remediation discussion at the supplied issue reference and upgrade to the vendor-recommended release once available; validate the update in a test environment because compatibility information is not provided.

If patching is delayed, limit local access to affected hosts, prevent untrusted users from invoking MJS-based functionality, and avoid opening untrusted content through affected workflows. Monitor application and system crash reports for recurring segmentation faults. No CISA KEV remediation due date applies because this CVE is not listed in KEV.

Technical context

CVSS v3.1 is 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The reported issue is a SEGV leading to denial of service; no specific CWE is assigned (NVD-CWE-noinfo). A public GitHub proof of concept is known, but the findings contain no confirmed in-the-wild exploitation and CISA KEV does not list the CVE. EPSS is 0.6% at the 48th percentile with a flat trend; this is predictive rather than evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Patch availablerecord updated
2022-01-27Publishedweakness classified

Affected products

cesantaoss-project
- mjsOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

github.com/cesanta/mjs/issues/220

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Mjs, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account