* The code first checks if the left-hand operand is a string.
* It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf).
* During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array).
* The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string.
This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| QuickJS | QuickJS | unaffected |
|
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Quickjs-ng
Subscribe
|
Quickjs
Subscribe
|
Project Subscriptions
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Wed, 29 Oct 2025 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Quickjs Project
Quickjs Project quickjs |
|
| CPEs | cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Quickjs Project
Quickjs Project quickjs |
|
| Metrics |
cvssV3_1
|
Tue, 21 Oct 2025 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Quickjs-ng
Quickjs-ng quickjs |
|
| Vendors & Products |
Quickjs-ng
Quickjs-ng quickjs |
Thu, 16 Oct 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 16 Oct 2025 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime. | |
| Title | Type confusion in string addition in QuickJS | |
| Weaknesses | CWE-704 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Google
Published:
Updated: 2025-10-16T17:46:39.174Z
Reserved: 2025-10-15T08:47:41.878Z
Link: CVE-2025-62494
Vulnrichment
Updated: 2025-10-16T17:46:23.878Z
NVD
Status : Analyzed
Published: 2025-10-16T16:15:39.943
Modified: 2025-10-29T18:58:16.497
Link: CVE-2025-62494
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-10-21T09:40:02Z