Technical impact
An issue in QuickJS‑NG v0.12.1 allows an attacker to execute arbitrary code by abusing the internal garbage‑collector function js_mapped_arguments_mark. The flaw is triggered when the function is invoked incorrectly during argument mapping, enabling malicious code to run with the privileges of the JavaScript engine. This is a classic code‑execution vulnerability described by CWE‑94 and can compromise confidentiality, integrity, and availability of any system embedding the affected engine.
Affected Systems
QuickJS‑NG version 0.12.1 is the only product identified as affected. The lightweight engine is used in embedded systems and applications that embed JavaScript execution; no additional vendors or product versions are currently reported as vulnerable.
Risk and Exploitability
The CVSS score of 7.3 indicates a high severity, yet the EPSS score of less than 1% suggests that exploitation is currently rare. The CVE is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is through the execution of malicious JavaScript that triggers the erroneous js_mapped_arguments_mark routine, possibly via crafted scripts or API calls. Although exploitation probability is low, the potential impact of remote code execution warrants careful assessment and timely mitigation.
