TI-2023-26063 Aliases CVE-2023-48183 GHSA-2c9q-jgx6-2qx7

QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an…

MEDIUM 40CWE-476Published 2024-04-23 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-476.

Summary

QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00641 50th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:quickjs_project:quickjs::::::::	before 2023-12-09	Vulnerable	QuickJS

cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* Versions before 2023-12-09 Vulnerable ·QuickJS

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-48183
2026-10-03 Alias added: GHSA-2c9q-jgx6-2qx7
2026-10-21 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/bellard/quickjs/issues/192

Patch 1

https://github.com/bellard/quickjs/commit/c4cdd61a3ed284cd760faf6b00bbf0cb908da077

TI-2025-38733 Use-after-free in js_std_promise_rejection_check in QuickJS CVSS 4.0HIGH 8.8
TI-2025-42911 A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit… CVSS 3.1HIGH 7.5
TI-2025-29366 quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt… CVSS 3.1HIGH 8.4
TI-2025-38738 Integer overflow in js_bigint_from_string in QuickJS CVSS 4.0HIGH 7.1
TI-2025-38737 Type confusion in string addition in QuickJS CVSS 4.0HIGH 7.1
TI-2025-38736 Type confusion in string addition in QuickJS CVSS 4.0HIGH 7.1

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences