CVE-2025-62496: Integer Overflow or Wraparound

A vulnerability exists in the QuickJS engine's BigInt string parsing logic jsbigintfromstring when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the necessary number of bits nbits required to store the BigInt using the formula:...

QuickJS 安全漏洞

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS that stems from an integer overflow in the BigInt string parsing logic, which could result in a heap out-of-bounds write...

CVE-2025-62494: Incorrect Type Conversion or Cast

A type confusion vulnerability exists in the handling of the string addition + operation within the QuickJS engine. The code first checks if the left-hand operand is a string. It then attempts to convert the right-hand operand to a primitive value using JSToPrimitiveFree. This conversion can...

QuickJS 安全漏洞

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS due to a type confusion when handling string addition operations, which could lead to out-of-bounds memory accesses and memory corruption to execute arbitrary code...

CVE-2025-62491: Use After Free

A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...

CVE-2025-62493: Out-of-bounds Read

A vulnerability exists in the QuickJS engine's BigInt string conversion logic jsbiginttostring1 due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. The function determines the number of characters ndigits...

PT-2025-42489

Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description An issue exists in the QuickJS engine related to floating-point arithmetic precision errors within the TypedArray.prototype.indexOf function when a negative fromIndex argument is provided...

PT-2025-42491

Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description A type confusion issue exists in the QuickJS engine related to how the string addition + operation is handled. The issue arises because an attacker can manipulate the type of the left-hand...

QuickJS 安全漏洞

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS, which stems from a floating-point precision error in the TypedArray.prototype.indexOf function when handling a negative fromIndex parameter, which could lead to out-of-bounds...

QuickJS 安全漏洞

QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS that stems from an inconsistent representation of buffer sizes due to an integer overflow in the regular expression engine, which could lead to out-of-bounds writes...

EUVD-2020-15632

Malware in sbrugna...

EUVD-2023-36211

Malicious code in bioql PyPI...

EUVD-2025-12428

Malicious code in bioql PyPI...

EUVD-2025-12432

Malicious code in bioql PyPI...

EUVD-2025-7259

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-46687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quickjs-ng through 0.9.0 has a missing length check in JSReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also...

Linux Distros Unpatched Vulnerability : CVE-2025-46688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quickjs-ng through 0.9.0 has an incorrect size calculation in JSReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is...

Linux Distros Unpatched Vulnerability : CVE-2024-33263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JSFreeRuntimeJSRuntime at quickjs.c. CVE-2024-33263 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2024-13903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JSGetRuntime of...

Linux Distros Unpatched Vulnerability : CVE-2023-48183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QuickJS before c4cdd61 has a buildforiniterator NULL pointer dereference because of an erroneous lexical scope of this with eval. CVE-2023-48183 Note that Nessu...