Quickjs Project
Quickjs Project Quickjs: vulnerabilidades y CVE
Quickjs Project Quickjs tiene 14 vulnerabilidades publicadas, 9 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses9
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-69654 | Alta (7.5) | 0.28% | — | 6 mar 2026 | A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an… |
| CVE-2025-69653 | Media (6.5) | 0.21% | — | 6 mar 2026 | A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file gc_decref_child in quickjs.c, when… |
| CVE-2025-62496 | Alta (7.1) | 0.48% | — | 16 oct 2025 | A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the… |
| CVE-2025-62495 | Alta (7.1) | 0.46% | — | 16 oct 2025 | An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. |
| CVE-2025-62494 | Alta (7.1) | 0.51% | — | 16 oct 2025 | A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. This mismatch between the assumed type (string) and the actual type allows an attacker to control the… |
| CVE-2025-62493 | Media (5.9) | 0.38% | — | 16 oct 2025 | A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the… |
| CVE-2025-62492 | Media (5.9) | 0.39% | — | 16 oct 2025 | A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. $$d_{new} = d +… |
| CVE-2025-62491 | Alta (8.8) | 0.41% | — | 16 oct 2025 | A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). |
| CVE-2025-62490 | Alta (8.8) | 0.41% | — | 16 oct 2025 | In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run… |
| CVE-2025-46688 | Alta (8.4) | 0.32% | — | 27 abr 2025 | quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected. |
| CVE-2023-48184 | Baja (3.9) | 0.34% | — | 23 abr 2024 | QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures. |
| CVE-2023-48183 | Alta (7.5) | 0.64% | — | 23 abr 2024 | QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval. |
| CVE-2023-31922 | Alta (7.5) | 0.73% | — | 12 may 2023 | QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. |
| CVE-2020-22876 | Alta (7.5) | 1.6% | — | 13 jul 2021 | Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.