QuickJS CVE-2025-62491

Exploitation requires that the QuickJS std library's unhandled-rejection reporting path (js_std_promise_rejection_check / js_std_dump_error1, part of quickjs-libc, as used by the qjs interpreter) is active, and that the attacker can execute JavaScript in the engine. The concrete trigger is an unhandled promise rejected with an Error object carrying a custom property getter (defined via Object.defineProperty) that, when invoked during error dumping, calls catch() on the same promise. The primary limiting factor is that the host application must evaluate untrusted/attacker-controlled JavaScript and must use the std library's rejection-tracking (this does not affect pure libquickjs embeddings that do not wire up js_std_promise_rejection_tracker); reliable UAF-to-code-execution also depends on heap grooming, making exploitation non-trivial.

This is a memory-safety flaw (CWE-416 Use-After-Free) in QuickJS's standard library (quickjs-libc), triggered when the unhandled-rejected-promise reporter iterates ts->rejected_promise_list and a malicious custom getter on an Error object calls catch() on the same promise, freeing the list entry still being iterated. Exploitation fundamentally requires the attacker to supply/execute JavaScript inside the QuickJS engine, so real-world risk is dominated by deployment context: it is high where an application evaluates untrusted/attacker-supplied scripts via the std library, and effectively low where only trusted local scripts run. Signals are mixed: a POC/exploit reference exists (Google issue tracker, tagged 'exploit'), the reporter is Google's CVE coordination team, and the input CVSS 4.0 base is 8.8 (High) - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. Note a conflict in the input CVSS 4.0 vector: it declares AV:A (adjacent-network), UI:P (passive user interaction) and a scope change (SC:H/SI:H), none of which the description supports - the description describes a local, attacker-controlled-script UAF with no network or remote-user element, so the provided vector appears mis-scored and should be treated with caution. No EPSS and no KEV means prioritization should rest on whether your deployment runs untrusted JS, not on the raw 8.8.

An application embeds QuickJS and evaluates attacker-supplied JavaScript (e.g., a scripting sandbox, serverless JS runtime, or qjs processing an untrusted script). The attacker creates a promise that rejects with an Error whose 'reason' property has a custom getter defined via Object.defineProperty; when the engine's unhandled-rejection reporter dumps the error, the getter runs and calls catch() on that same promise, freeing the list entry mid-iteration and producing a UAF that can corrupt memory and potentially lead to arbitrary code execution in the host process. A public exploit/POC is referenced in the Google issue tracker.