CVE-2025-62494
Type confusion in string addition in QuickJS
Description
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime.
INFO
Published Date :
Oct. 16, 2025, 4:15 p.m.
Last Modified :
Oct. 19, 2026, 4:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 14ed7db2-1595-443d-9d34-6215bf890778 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update QuickJS to a version that fixes type confusion.
- Ensure operands are strings before concatenation.
- Perform thorough type checks after primitive conversion.
- Implement memory safety checks during string operations.
Public PoC/Exploit Available at Github
CVE-2025-62494 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-62494.
| URL | Resource |
|---|---|
| https://bellard.org/quickjs/Changelog | Release Notes |
| https://issuetracker.google.com/434193023 | Exploit Issue Tracking |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-62494 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-62494
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Tracking CVEs discovered by AI systems — Anthropic, OpenAI, Google Big Sleep, Microsoft MDASH, DepthFirst
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-62494 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-62494 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: QuickJS, Description: Existe una vulnerabilidad de confusión de tipos en el manejo de la operación de adición de cadenas (+) dentro del motor QuickJS. * El código primero verifica si el operando de la izquierda es una cadena. * Luego intenta convertir el operando de la derecha a un valor primitivo usando JS_ToPrimitiveFree. Esta conversión puede activar una devolución de llamada (por ejemplo, toString o valueOf). * Durante esta devolución de llamada, un atacante puede modificar el tipo del operando de la izquierda en memoria, cambiándolo de una cadena a un tipo diferente (por ejemplo, un objeto o un array). * El código luego procede a llamar a JS_ConcatStringInPlace, que aún trata el valor de la izquierda modificado como una cadena. Este desajuste entre el tipo asumido (cadena) y el tipo real permite a un atacante controlar la estructura de datos que está siendo procesada por la lógica de concatenación, lo que resulta en una condición de confusión de tipos. Esto puede llevar a un acceso a memoria fuera de límites, lo que podría resultar en corrupción de memoria y ejecución de código arbitrario en el contexto del entorno de ejecución de QuickJS. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'QuickJS', 'product': 'QuickJS', 'versions': [{'status': 'affected', 'version': '2025-04-26', 'lessThan': '2025-09-13', 'versionType': 'date'}], 'packageName': 'JS_ConcatStringInPlace', 'collectionURL': 'https://bellard.org/quickjs/', 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-62494', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-10-16T17:46:18.542287Z'} -
Initial Analysis by [email protected]
Oct. 29, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* versions up to (excluding) 2025-09-13 Added Reference Type Google Inc.: https://bellard.org/quickjs/Changelog Types: Release Notes Added Reference Type Google Inc.: https://issuetracker.google.com/434193023 Types: Exploit, Issue Tracking -
New CVE Received by [email protected]
Oct. 16, 2025
Action Type Old Value New Value Added Description A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime. Added CVSS V4.0 AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-704 Added Reference https://bellard.org/quickjs/Changelog Added Reference https://issuetracker.google.com/434193023