QuickJS CVE-2025-62494

Exploitation requires the attacker to execute attacker-controlled JavaScript inside the QuickJS engine and to register a valueOf/toString callback on the right-hand operand of a string '+' operation that reassigns the left-hand operand to a non-string type (object/array) mid-evaluation - this callback manipulation IS the core precondition. Limiting factors per the vendor CVSS 4.0 vector: AC:H and AT:P indicate a specific, non-trivial condition and timing must be met; PR:L means some level of authenticated/low-privilege access to the runtime is needed; UI:P implies passive user interaction; and AV:A scopes it to adjacent reach rather than open internet. Realistic impact therefore hinges on whether the embedding product evaluates untrusted/remote JavaScript - engines that only run trusted first-party scripts are not meaningfully exposed.

This is a genuine but conditional priority, not an inflated high-CVSS artifact. The CWE-704 type confusion in QuickJS's string '+' handling is a real memory-corruption primitive (OOB access → potential arbitrary code execution) and a public exploit exists on Google's issue tracker (issuetracker.google.com/434193023), reported by Google's CVE coordination team - a credible source that raises the realism of weaponization. However, the vendor-supplied CVSS is 4.0 only (7.1) with a notably restrictive vector: AV:A (adjacent), AC:H (high complexity), AT:P (a specific attack requirement must hold), PR:L (low privileges required), and UI:P (passive user interaction). These signals collectively indicate exploitation is not trivial 'spray-and-pray' - it requires the ability to run crafted JavaScript in the QuickJS runtime and to win the type-swap timing inside the toString/valueOf callback. There is NO CISA KEV listing and NO EPSS score provided, so widespread opportunistic exploitation is NOT evidenced; the public POC indicates capability, not active in-the-wild campaigns. Note a tension to verify: the vendor marks AV:A/PR:L, whereas the vulnerability class (a JS engine processing attacker-controlled script) is commonly modeled as content-delivery rather than adjacent-network - the realistic access path depends entirely on how a given product embeds QuickJS, so defenders should confirm their exposure surface with the embedding vendor rather than relying on AV:A alone.

An attacker supplies crafted JavaScript to an application embedding QuickJS; the script performs a string concatenation where the right-hand operand's toString/valueOf callback reassigns the left-hand operand from a string to an object or array, so JS_ConcatStringInPlace then operates on a mismatched type. This yields out-of-bounds access and memory corruption that can be groomed into arbitrary code execution within the QuickJS runtime's process context. A publicly available exploit/POC exists on Google's issue tracker, so working trigger code is accessible.