CVE-2020-13623: 
NixOS vulnerability analysis and mitigation

JerryScript 2.2.0 contains a denial of service vulnerability (CVE-2020-13623) that allows attackers to cause stack consumption via a proxy operation. The vulnerability was discovered in May 2020 and affects the JavaScript engine's proxy object handling (NVD).

The vulnerability exists in the proxy object handling functionality of JerryScript's JavaScript engine. When processing proxy operations through ecma_proxy_object_get and ecma_proxy_object_set functions, an attacker can trigger uncontrolled stack consumption. This can be demonstrated by creating a proxy object and setting its proto property to reference itself, leading to infinite recursion (GitHub Issue).

The vulnerability allows attackers to cause a denial of service condition through stack exhaustion. When successfully exploited, it can lead to application crashes and service disruption (CISA).

The vulnerability can be triggered by providing specially crafted JavaScript code that creates a proxy object with circular references. A proof-of-concept exists demonstrating the issue using proxy objects and prototype chain manipulation (GitHub Issue).

The vulnerability was addressed in versions after JerryScript 2.2.0. Users should upgrade to a patched version of the software to mitigate this issue (NVD).