QuickJS CVE-2025-62490

Exploitation requires that the embedding application (a) execute attacker-influenced JavaScript in QuickJS and (b) invoke the object-printing path (js_print_object / print / dump) on an attacker-crafted Array, Map, or Set whose elements trigger a user-defined callback (getter, Proxy trap, or valueOf/toString) during js_print_value; that callback must resize or remove elements so the previously fetched array length (len1) or the ms->records list becomes stale. LIMITING FACTORS: deployments that never print/dump attacker-controlled objects, or that do not run untrusted script, are not reachable; reliable code execution (versus a crash) additionally requires heap grooming to control the freed allocation. This is therefore a usage/configuration-dependent bug rather than a default remote-unauthenticated flaw.

Signals are mixed and must be weighed against deployment context. The input CVSS 4.0 vector (base 8.8) describes a fairly constrained path (AV:A adjacent, AC:H high complexity, AT:P present attack requirement, UI:P passive user interaction) yet rates confidentiality/integrity High with a scope change - this is internally tense for a scripting-engine memory-corruption bug, since in most QuickJS embeddings the triggering JavaScript executes in-process rather than over an adjacent network with user interaction. A publicly available exploit/PoC exists (Google issue tracker), which raises practical risk. This CVE is NOT listed in CISA KEV and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation and no modeled exploitation probability to cite - these are missing data, not low values. Reported by Google's CVE coordination team and classified CWE-416 (use-after-free), the technical impact is genuine memory corruption that can escalate to code execution. Net: treat as a real priority for any product that evaluates untrusted/attacker-influenced JavaScript through QuickJS and prints objects, but materially lower priority for deployments that never run untrusted scripts. Note the conflict explicitly: the provided CVSS 4.0 vector implies adjacent access plus user interaction, whereas the description implies the vulnerability is reached by executing attacker-supplied script and printing a crafted object - verify the real exploitation path against your embedding.

An application embeds QuickJS and evaluates untrusted JavaScript, then prints or dumps a resulting object (e.g., via print()/console.log-style output). The attacker supplies a script defining an array (or Map/Set) whose element access runs an attacker-defined callback during js_print_value; that callback resizes/empties the container mid-iteration so the cached length (len1) or records list points at freed memory, triggering a use-after-free. A public PoC exists on Google's issue tracker, so the trigger is reproducible, though reliable code execution still requires heap grooming.