CVE-2025-62494
Type confusion in string addition in QuickJS
Published Oct 16, 2025
CVSS 4.0 · 7.1 High
EPSS < 1%
KEV · Not listed
Description
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine.
* The code first checks if the left-hand operand is a string.
* It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf).
* During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array).
* The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string.
This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
* The code first checks if the left-hand operand is a string.
* It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf).
* During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array).
* The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string.
This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| QuickJS | QuickJS | unaffected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Quickjs-ng | Quickjs | — |
Remediation
Tracking
Advisories
Metrics
Attack Vector Adjacent Network
Attack Complexity High
Privileges Required Low
Attack Requirements Present
User Interaction Passive
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact High
Vulnerable System Availability Impact Low
Subsequent System Confidentiality Impact High
Subsequent System Integrity Impact High
Subsequent System Availability Impact Low
Attack Vector Adjacent Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.526% probability within 30 days)
Exploitation poc
Automatable no
Technical Impact total
References
History
Oct 29, 2025 7:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Quickjs Project
Quickjs Project quickjs |
|
| CPEs | cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Quickjs Project
Quickjs Project quickjs |
|
| Metrics |
cvssV3_1
|
Oct 21, 2025 9:45 AM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Quickjs-ng
Quickjs-ng quickjs |
|
| Vendors & Products |
Quickjs-ng
Quickjs-ng quickjs |
Oct 16, 2025 6:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Oct 16, 2025 4:00 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime. | |
| Title | Type confusion in string addition in QuickJS | |
| Weaknesses | CWE-704 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
Weaknesses
