CVE-2014-2208: Facebook Hiphop Virtual Machine

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

Affected products

• Facebook Hiphop Virtual Machine: up to and including 2.4.1

Published 2014-12-28. Last modified 2026-06-17.