CVE-2025-46687 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.6 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
mitre	CNA	5.6 MEDIUM				CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA-ADP	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 3%

Debian Releases

Debian Product

Codename

quickjs

trixie	vulnerable
sid	2025.04.26-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

quickjs

plucky	needs-triage
oracular	needs-triage
noble	needs-triage
jammy	dne
focal	dne

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://bellard.org/quickjs/Changelog

https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a

https://github.com/bellard/quickjs/issues/399

https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465

https://github.com/quickjs-ng/quickjs/issues/1018

https://github.com/quickjs-ng/quickjs/pull/1020