Product:
quickjs
Summary
In quickjs, there is a vulnerability in the js_print_object function when printing arrays. The function fetches the array length and loops over it, but printing a value can lead to a use-after-free condition due to an attacker-defined callback. This issue also occurs when printing map or set objects, where elements can be removed during the printing process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-62490 |
Exploitation
To exploit this vulnerability, an attacker can define a callback that modifies the array or map/set while it is being printed. By manipulating the data structure during the execution of js_print_value, the attacker can cause the program to access freed memory, leading to potential arbitrary code execution or crashes.
Affected Products
- quickjs: A lightweight JavaScript engine that may be vulnerable when handling arrays and map/set objects.
Mitigation
To mitigate this vulnerability, it is recommended to avoid using attacker-controlled callbacks during the printing of arrays and map/set objects. Additionally, developers should ensure proper memory management and implement checks to prevent resizing of data structures during critical operations.