QuickJS 0.9.0/3b45d15 JS_ToPrimitiveFree type conversion

Summaryinfo

A vulnerability classified as critical was found in QuickJS. The affected element is the function JS_ToPrimitiveFree. The manipulation results in type conversion. This vulnerability was named CVE-2025-62494. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in QuickJS. Affected is the function JS_ToPrimitiveFree. The manipulation with an unknown input leads to a type conversion vulnerability. CWE is classifying the issue as CWE-704. The product does not correctly convert an object, resource, or structure from one type to a different type. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.

The advisory is available at bellard.org. This vulnerability is traded as CVE-2025-62494 since 10/15/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 270718 (Linux Distros Unpatched Vulnerability : CVE-2025-62494), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2025-09-13 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (270718). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• QuickJS

Version

• 0.9.0
• 3b45d15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion