Product:
QuickJS
Summary
A Use-After-Free vulnerability exists in the QuickJS engine’s standard library when iterating over the global list of unhandled rejected promises. The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections. If the promise rejection reason is an Error object with a custom property getter, this getter can execute JavaScript code that calls catch() on the same rejected promise, leading to a Use-After-Free condition.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-62491 |
Exploitation
To exploit this vulnerability, an attacker can create a promise rejection with a custom getter that executes malicious JavaScript code. When the js_std_promise_rejection_check function processes this rejection, it will call the custom getter during the error dumping process. If the getter calls catch() on the same promise, it will remove the promise from the list while the iteration is still ongoing, resulting in a Use-After-Free condition that can be leveraged to execute arbitrary code.
Affected Products
- QuickJS: A lightweight JavaScript engine that can be embedded in applications.
Mitigation
To mitigate this vulnerability, it is recommended to update the QuickJS engine to the latest version where this issue has been addressed. Additionally, developers should avoid using custom property getters in Error objects that may be processed during promise rejection handling.