CVE-2022-44789

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.1 allows an...

8.8 HighPublic exploitFix available

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.50%Down 10.1 points since Nov 24, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2022-44789
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2022-44789
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2022-47721 8.8

Record: EUVD-2022-47721
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-57j3-gx8q-fwcj 8.8

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.1 allows an...

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.1 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Record: GHSA-57j3-gx8q-fwcj
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

OSV 8.8

Record: CVE-2022-44789
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2023-1137 8.8

mujs security update

MuJS is a lightweight Javascript interpreter designed for embedding in other software to extend them with scripting capabilities.

Security Fix(es):

Record: OESA-2023-1137
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2023-1138 8.8

mujs security update

MuJS is a lightweight Javascript interpreter designed for embedding in other software to extend them with scripting capabilities.

Security Fix(es):

Record: OESA-2023-1138
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-44789 8.8

Record: UBUNTU-CVE-2022-44789
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-44789 No score

Record: DEBIAN-CVE-2022-44789
Updated: 2026-11-03

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mujs` Debian:12	before 1.3.2-1	1.3.2-1
`mujs` Debian:13	before 1.3.2-1	1.3.2-1
`mujs` Debian:14	before 1.3.2-1	1.3.2-1
`mujs` Debian:11 From an advisory covering 3 CVEs	before 1.1.0-1+deb11u2, plus listed versions 1.1.0-11.1.0-1+deb11u1	1.1.0-1+deb11u2
`mujs` openEuler:22.03-LTS	before 1.2.0-3.oe2203	1.2.0-3.oe2203
`mujs` openEuler:22.03-LTS-SP1	before 1.2.0-3.oe2203sp1	1.2.0-3.oe2203sp1
`mujs` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.1.0-11.1.3-21.1.3-31.1.3-3ubuntu0.1~esm1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	alalng/CVE-2022-44789	2022-11-22

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-44789 is a high vulnerability (CVSS 8.8) in Artifex Mujs, published November 23, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.50%, the 84th percentile. Fixed in mujs 1.3.2-1.

References

Show 8 moreShow less