{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-62490 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2025-62490 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-62490 is a high-severity use after free vulnerability in QuickJS, published on 16 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-62490 and fix it if it is affected.\n\nWhat it is: CVE-2025-62490 is a high-severity use after free vulnerability in QuickJS, published on 16 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2025-62490 in the wild and no public exploit code.\n\nAffected product: QuickJS. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-62490/ (Markdown: https://insights.sbomify.com/CVE-2025-62490/index.md)","id":"CVE-2025-62490","markdown":"https://insights.sbomify.com/CVE-2025-62490/index.md","name":"CVE-2025-62490","record":{"aliases":["DEBIAN-CVE-2025-62490","GHSA-g55w-pj8g-frvg","UBUNTU-CVE-2025-62490"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"JavaScript engine library","requires_auth":"none","summary":"An attacker can trigger a use-after-free in QuickJS by exploiting side effects during array or map printing, potentially leading to code execution or crashes.","user_interaction":"required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Google","cpe":[{"product":"quickjs","vendor":"quickjs_project"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","version":"4.0"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms-\u003erecords list, but once again, elements could be removed from the list during js_print_value call.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Use-after-free in js_print_object in QuickJS","id":"CVE-2025-62490","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"Use-after-free in js_std_promise_rejection_check in QuickJS","id":"CVE-2025-62491"},"packages":[],"prev":{"headline":"Missing authorization in com.palantir.acme:dossier-app","id":"CVE-2025-62487"},"products":["QuickJS"],"published":"2025-10-16","related":[{"cvss_score":8.8,"headline":"Use-after-free in js_std_promise_rejection_check in QuickJS","id":"CVE-2025-62491","kev_date_added":null,"published":"2025-10-16"},{"cvss_score":7.5,"headline":"Denial of service in n/a","id":"CVE-2025-69654","kev_date_added":null,"published":"2026-03-06"},{"cvss_score":7.5,"headline":"Null dereference in n/a","id":"CVE-2023-48183","kev_date_added":null,"published":"2024-04-23"},{"cvss_score":7.5,"headline":"Denial of service in n/a","id":"CVE-2023-31922","kev_date_added":null,"published":"2023-05-12"},{"cvss_score":7.5,"headline":"Memory corruption in n/a","id":"CVE-2020-22876","kev_date_added":null,"published":"2021-07-13"},{"cvss_score":7.1,"headline":"Type confusion in string addition in QuickJS","id":"CVE-2025-62494","kev_date_added":null,"published":"2025-10-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-16","vendors":["QuickJS"]},"summary":"An attacker can trigger a use-after-free in QuickJS by exploiting side effects during array or map printing, potentially leading to code execution or crashes.","url":"https://insights.sbomify.com/CVE-2025-62490/"}