Product:
QuickJS
Summary
A type confusion vulnerability exists in the handling of the string addition operation within the QuickJS engine. The vulnerability arises when the left-hand operand is treated as a string while the right-hand operand is converted to a primitive value. An attacker can exploit this by modifying the type of the left-hand operand in memory, leading to a mismatch that allows for out-of-bounds memory access and potential arbitrary code execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2025-62494 |
Exploitation
To exploit this vulnerability, an attacker can craft a specific input that triggers the string addition operation. By manipulating the right-hand operand during the conversion process, the attacker can change the type of the left-hand operand in memory. This results in the QuickJS engine treating a non-string type as a string, which can lead to memory corruption and the execution of arbitrary code within the QuickJS runtime.
Affected Products
- QuickJS: A lightweight JavaScript engine that is vulnerable to type confusion due to improper handling of string addition.
Mitigation
To mitigate this vulnerability, it is recommended to update the QuickJS engine to the latest version where this issue has been addressed. Additionally, developers should implement strict type checks and validation to prevent type confusion scenarios in their applications.