CVE-2023-48183

CVE-2023-48183 affects QuickJS prior to commit c4cdd61. The vulnerability stems from an erroneous lexical scope of the value of this with eval, causing a NULL pointer dereference in build_for_in_iterator. Documented impact includes possible crashes/denial of service and potential arbitrary code e...

CVE-2023-31922

CVE-2023-31922 affects QuickJS, specifically the js_proxy_isArray path in quickjs.c, where a stack overflow can trigger a crash. The issue is tied to commit 2788d71. Public docs indicate a DoS/crash impact but do not provide exploitation details. Remediation mentioned in the sources includes upgr...

CVE-2020-22876

CVE-2020-22876 relates to a buffer overflow in QuickJS (source: quickjs.c). The vulnerability allows remote denial of service via a crafted input and is mitigated by a fix released on 2020-07-05. Affected component is the QuickJS engine; root cause is a buffer overflow in quickjs.c leading to mem...

CVE-2025-69654

CVE-2025-69654 concerns the QuickJS qjs interpreter. A crafted JavaScript input, when run with the -m option and a low memory limit on the QuickJS release 2025-09-13, can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during r...