CVE-2025-62494
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-704
Conversión de tipos errónea
Fecha de publicación:
16/10/2025
Última modificación:
29/10/2025
Descripción
*** Pendiente de traducción *** A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine.<br />
<br />
* The code first checks if the left-hand operand is a string.<br />
<br />
<br />
* It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf).<br />
<br />
<br />
* During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array).<br />
<br />
<br />
* The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string.<br />
<br />
<br />
This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
Impacto
Puntuación base 4.0
7.10
Gravedad 4.0
ALTA
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* | 2025-09-13 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página