CVE-2025-62494
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-29

Assigner: Google Inc.

Description
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-16
Last Modified
2025-10-29
Generated
2026-05-06
AI Q&A
2025-10-16
EPSS Evaluated
2026-05-05
NVD
CVE-2025-62494
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
quickjs_project quickjs to 2025-09-13 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-704 The product does not correctly convert an object, resource, or structure from one type to a different type.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a type confusion issue in the QuickJS engine's string addition operation. When adding strings, the engine first checks if the left operand is a string, then converts the right operand to a primitive value, which can trigger a callback like toString or valueOf. During this callback, an attacker can change the type of the left operand in memory from a string to another type such as an object or array. The engine then continues to treat the left operand as a string, causing a mismatch between the assumed and actual types. This type confusion can lead to out-of-bounds memory access, memory corruption, and potentially arbitrary code execution within the QuickJS runtime.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to execute arbitrary code within the QuickJS runtime environment by exploiting the type confusion to cause memory corruption. This could lead to unauthorized actions, data manipulation, or system compromise depending on how QuickJS is used in your environment.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart