Quickjs
Monthly
Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. [CVSS 7.5 HIGH]
A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file gc_decref_child in quickjs.c, when executed with the qjs interpreter using the -m option. [CVSS 6.5 MEDIUM]
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remote attackers to corrupt memory and potentially achieve code execution with user interaction. Public exploit code exists for this vulnerability, increasing practical attack risk. A patch is available and should be applied immediately.
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory corruption without authentication. Public exploit code exists for this vulnerability, enabling potential information disclosure or denial of service. A patch is available and should be applied immediately.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attackers to corrupt memory and potentially achieve code execution with minimal user interaction. Public exploit code exists for this vulnerability. Users should apply the available patch (commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5) to remediate the risk.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthenticated remote attackers to corrupt memory and potentially execute arbitrary code. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Affected users should apply patch c5d80831e51e48a83eab16ea867be87f091783c5 immediately.
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Heap out-of-bounds write in QuickJS's BigInt string parser can corrupt memory when an embedding application converts an excessively long decimal string (roughly 79,536,432 digits or more) into a BigInt. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Practical exposure is constrained because the application must accept and forward an approximately 80 MB attacker-controlled string to BigInt parsing, and reliable code execution beyond a crash requires heap grooming; default input-size limits or sane validation usually prevent the trigger.
Integer overflow in QuickJS's libregexp bytecode accounting can become an out-of-bounds write when a crafted recursive regular expression expands compiled bytecode past 2^31 bytes; publicly available exploit code exists and no CISA KEV confirmation was provided. The authoritative assessment treats this as local with no required privileges (PR:N), but exploitation is difficult because the attacker must already be able to feed a regex into the QuickJS-embedding application and must induce a multi-gigabyte bytecode allocation, with high confidentiality, integrity, and availability impact in changed scope.
Type confusion in QuickJS's handling of the string addition (+) operation allows local attackers to trigger out-of-bounds memory access, potentially leading to memory corruption and arbitrary code execution. The flaw arises when a callback (e.g., toString or valueOf) invoked during conversion of the right-hand operand modifies the left-hand operand's type from string to object, after which JS_ConcatStringInPlace still treats it as a string. Publicly available exploit code exists, and our independent assessment rates the attack as local, high complexity, with no privileges or user interaction required, though the vendor's CVSS 4.0 vector indicates adjacent access and low privileges.
An out-of-bounds heap read in QuickJS's BigInt-to-string conversion (js_bigint_to_string1) lets script-controlled BigInt values leak memory adjacent to the BigInt limb buffer. Any embedding that executes untrusted JavaScript and permits BigInt-to-string conversion with a power-of-two radix such as 32 is affected; the CPE entry (cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*) carries no version bound, so all builds without the upstream fix should be treated as vulnerable. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV) and EPSS is low at 0.38% (31st percentile), consistent with an information-disclosure-only primitive whose real value depends on heap layout; the independent assessment rates confidentiality impact as limited rather than severe.
Information disclosure in QuickJS occurs through a floating-point precision error in TypedArray.prototype.indexOf() when a negative fromIndex such as -1e-20 is added to the array length and rounds exactly to the length, causing a one-element out-of-bounds read. Applications embedding QuickJS and executing attacker-controlled JavaScript are affected; the supplied data does not enumerate exact version boundaries. Publicly available exploit code exists, EPSS is 0.39% (32nd percentile), and the independent assessment limits impact to low confidentiality disclosure with no integrity or availability impact.
A use-after-free in QuickJS's quickjs-libc standard library lets JavaScript code corrupt heap memory from inside the interpreter's own unhandled-promise reporter: when a rejected promise's reason is an Error carrying a JavaScript-defined property getter, dumping that error re-enters the script engine and a catch() call frees the promise entry that the reporter is still iterating. Per the authoritative assessment this is a local, high-complexity memory-safety issue (CVSS 3.1 AV:L/AC:H, high confidentiality and integrity impact) that requires the host to evaluate attacker-controlled JavaScript using the qjs interpreter's rejection-tracking helpers; bare libquickjs embeddings that do not register the rejection tracker are unaffected. Publicly available exploit code exists, though turning the UAF into reliable code execution additionally depends on heap grooming and makes exploitation non-trivial.
Use-after-free in QuickJS object-printing routines can corrupt memory when an attacker-influenced Array, Map, or Set is printed and a JavaScript callback mutates the container during js_print_value. The bug affects QuickJS deployments that expose the print/dump path to untrusted script; exploitation is usage- and configuration-dependent because the embedding application must execute attacker-influenced JavaScript and then print or dump the crafted object. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and reliable code execution beyond a crash requires heap grooming.
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. [CVSS 7.5 HIGH]
A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file gc_decref_child in quickjs.c, when executed with the qjs interpreter using the -m option. [CVSS 6.5 MEDIUM]
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remote attackers to corrupt memory and potentially achieve code execution with user interaction. Public exploit code exists for this vulnerability, increasing practical attack risk. A patch is available and should be applied immediately.
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory corruption without authentication. Public exploit code exists for this vulnerability, enabling potential information disclosure or denial of service. A patch is available and should be applied immediately.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attackers to corrupt memory and potentially achieve code execution with minimal user interaction. Public exploit code exists for this vulnerability. Users should apply the available patch (commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5) to remediate the risk.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthenticated remote attackers to corrupt memory and potentially execute arbitrary code. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Affected users should apply patch c5d80831e51e48a83eab16ea867be87f091783c5 immediately.
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available.
Heap out-of-bounds write in QuickJS's BigInt string parser can corrupt memory when an embedding application converts an excessively long decimal string (roughly 79,536,432 digits or more) into a BigInt. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. Practical exposure is constrained because the application must accept and forward an approximately 80 MB attacker-controlled string to BigInt parsing, and reliable code execution beyond a crash requires heap grooming; default input-size limits or sane validation usually prevent the trigger.
Integer overflow in QuickJS's libregexp bytecode accounting can become an out-of-bounds write when a crafted recursive regular expression expands compiled bytecode past 2^31 bytes; publicly available exploit code exists and no CISA KEV confirmation was provided. The authoritative assessment treats this as local with no required privileges (PR:N), but exploitation is difficult because the attacker must already be able to feed a regex into the QuickJS-embedding application and must induce a multi-gigabyte bytecode allocation, with high confidentiality, integrity, and availability impact in changed scope.
Type confusion in QuickJS's handling of the string addition (+) operation allows local attackers to trigger out-of-bounds memory access, potentially leading to memory corruption and arbitrary code execution. The flaw arises when a callback (e.g., toString or valueOf) invoked during conversion of the right-hand operand modifies the left-hand operand's type from string to object, after which JS_ConcatStringInPlace still treats it as a string. Publicly available exploit code exists, and our independent assessment rates the attack as local, high complexity, with no privileges or user interaction required, though the vendor's CVSS 4.0 vector indicates adjacent access and low privileges.
An out-of-bounds heap read in QuickJS's BigInt-to-string conversion (js_bigint_to_string1) lets script-controlled BigInt values leak memory adjacent to the BigInt limb buffer. Any embedding that executes untrusted JavaScript and permits BigInt-to-string conversion with a power-of-two radix such as 32 is affected; the CPE entry (cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*) carries no version bound, so all builds without the upstream fix should be treated as vulnerable. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV) and EPSS is low at 0.38% (31st percentile), consistent with an information-disclosure-only primitive whose real value depends on heap layout; the independent assessment rates confidentiality impact as limited rather than severe.
Information disclosure in QuickJS occurs through a floating-point precision error in TypedArray.prototype.indexOf() when a negative fromIndex such as -1e-20 is added to the array length and rounds exactly to the length, causing a one-element out-of-bounds read. Applications embedding QuickJS and executing attacker-controlled JavaScript are affected; the supplied data does not enumerate exact version boundaries. Publicly available exploit code exists, EPSS is 0.39% (32nd percentile), and the independent assessment limits impact to low confidentiality disclosure with no integrity or availability impact.
A use-after-free in QuickJS's quickjs-libc standard library lets JavaScript code corrupt heap memory from inside the interpreter's own unhandled-promise reporter: when a rejected promise's reason is an Error carrying a JavaScript-defined property getter, dumping that error re-enters the script engine and a catch() call frees the promise entry that the reporter is still iterating. Per the authoritative assessment this is a local, high-complexity memory-safety issue (CVSS 3.1 AV:L/AC:H, high confidentiality and integrity impact) that requires the host to evaluate attacker-controlled JavaScript using the qjs interpreter's rejection-tracking helpers; bare libquickjs embeddings that do not register the rejection tracker are unaffected. Publicly available exploit code exists, though turning the UAF into reliable code execution additionally depends on heap grooming and makes exploitation non-trivial.
Use-after-free in QuickJS object-printing routines can corrupt memory when an attacker-influenced Array, Map, or Set is printed and a JavaScript callback mutates the container during js_print_value. The bug affects QuickJS deployments that expose the print/dump path to untrusted script; exploitation is usage- and configuration-dependent because the embedding application must execute attacker-influenced JavaScript and then print or dump the crafted object. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and reliable code execution beyond a crash requires heap grooming.
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.