CVE-2025-46687 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.6 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
mitre	CNA	5.6 MEDIUM				CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 8%

Vendor	Product	Version
bellard	quickjs	𝑥 < 2025-04-26
quickjs-ng	quickjs	𝑥 ≤ 0.9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

quickjs

forky	2025.04.26-1 fixed
sid	2025.04.26-1 fixed
trixie	2025.04.26-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

quickjs

questing	needs-triage
plucky	ignored
oracular	ignored
noble	needs-triage
jammy	dne
focal	dne

Known Exploits!

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://bellard.org/quickjs/Changelog

https://github.com/bellard/quickjs/commit/1eb05e44fad89daafa8ee3eb74b8520b4a37ec9a

https://github.com/bellard/quickjs/issues/399

https://github.com/quickjs-ng/quickjs/commit/28fa43d3ddff2c1ba91b6e3a788b2d7ba82d1465

https://github.com/quickjs-ng/quickjs/issues/1018

https://github.com/quickjs-ng/quickjs/pull/1020