Critical
Security advisory
Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-22874
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.
osv:CVE-2020-22874
Complete source record
{
"id": "082ecfc4ee44a64c5b0d1469f2fdbf0c8de5841f071b89eb60cc5b789dcbc75c",
"url": "https://osv.dev/vulnerability/CVE-2020-22874",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-22874",
"summary": "Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code.",
"evidence": "osv:CVE-2020-22874",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-22874",
"aliases": [
"CVE-2020-22874"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pcmacdon/jsish",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "858da537bde4de9d8c92466d5a866505310bc328"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "858da537bde4de9d8c92466d5a866505310bc328"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-22874.json",
"vanir_signatures": [
{
"id": "CVE-2020-22874-0095c650",
"digest": {
"threshold": 0.9,
"line_hashes": [
"202206351058892856260573845045713298942",
"131613120852156024249436583106160713804",
"115343551472456355214492719486222050789",
"302931350087201046956865953107752227928",
"19194874872551402985605542793199301390",
"38950074411595799094338931258172200146",
"118242455269030763046840636725588167434",
"281779591134081646680921127782472736840",
"99334141839382299141250438365342349500",
"79604531955387046490826320044570897103",
"70787085119214832182565774140990076051",
"213724755942381815695908253714905864027"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiInterp.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-0c666115",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157845662099615217345996781234950210549",
"205689039989110797671845534079127765828",
"172912923894550398179665174054928698538",
"172283037334713290254760529888640714854"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiInt.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-1251078c",
"digest": {
"length": 646,
"function_hash": "168224442810609026816070834887631445239"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiObj.c",
"function": "Jsi_ObjArraySizer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-1811a31c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"17608338619224154507432247404878548253",
"175199290779722145789801114718366460264",
"19859378292462114681187694519512095770",
"6215026486100820483009030974144285172"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiArray.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-1a7aff31",
"digest": {
"length": 557,
"function_hash": "323429002001689139426992597742905544915"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiValue.c",
"function": "Jsi_ValueInsertArray"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-1cfb62d0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"339943975686569814490554239315737086604",
"280757539070662154855197268845882301424",
"187800012601015727853244555609703459326",
"141859195676548413304971031209460637026",
"41922006643038761381358003821270295946",
"74471401105749468929386464724938908679",
"240953856817251607367881944445912050873",
"338234158375969879503813123243930671674"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiValue.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-5c4c2777",
"digest": {
"length": 602,
"function_hash": "71148092029613014378151265980082011055"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiObj.c",
"function": "ObjListifyCallback"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-6b213e9a",
"digest": {
"length": 5613,
"function_hash": "184034187485478493095902782339187638265"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiCData.c",
"function": "CDataStructDefineCmd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-6e9df9bb",
"digest": {
"length": 16406,
"function_hash": "247767554942924203620319243852516650620"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiInterp.c",
"function": "jsi_InterpNew"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-bee12dd7",
"digest": {
"length": 918,
"function_hash": "31192272240537287670970115722147461036"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiValue.c",
"function": "jsi_ValueObjKeyAssign"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-e1ec931e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"9149341086160505057419576682860351595",
"318245099965756809946153529065333964327",
"223661189659862932776079676325930809388",
"173724375446540878652993041140200497899",
"252005883819654374358125278240071748603",
"206443891900787354334941690445662585742",
"143002426475488471795344107070573237887",
"201913497176703988431825136881472087894",
"67831652941639897455716788194453874571",
"12223678430553005783008348848169853433",
"333050108104863352204428022682569389638",
"42183910712188964182009291583388035558",
"161218196594016197184505323248669714224"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiObj.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-ec757d2b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255520844668788751141109450842856837895",
"89151864832078375453226726224516646796",
"199606037366710635029004105287745038783",
"261853860623133326061768501038367072427",
"181584547942781680686472196475925286414"
]
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiCData.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-22874-f43bd923",
"digest": {
"length": 642,
"function_hash": "58843197263898162944120908336221959759"
},
"source": "https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"target": {
"file": "src/jsiArray.c",
"function": "jsi_ArrayFlatSub"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:55:25Z"
}
}
],
"modified": "2026-10-20T13:55:25.177930818Z",
"provider": "osv",
"references": [
"https://github.com/pcmacdon/jsish/commit/858da537bde4de9d8c92466d5a866505310bc328",
"https://github.com/pcmacdon/jsish/issues/5"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:jsish:jsish:*:*:*:*:*:*:*:*"
],
"vendor_product": "jsish:jsish",
"extracted_events": [
{
"range": [
{
"fixed": "3.0.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "3.0.8"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-22874",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388375,
"published_at": "2021-07-13T15:15:08.457+00:00"
}