Arbitrary Code Execution in QuickJS-NG Affected by Security Flaw
CVE-2026-37630

7.3HIGH

Key Information:

Vendor

QuickJS-NG

Status
QuickJS-NG
Vendor
CVE Published:
11 May 2026

What is CVE-2026-37630?

A security flaw in QuickJS-NG version 0.12.1 allows attackers to exploit the js_mapped_arguments_mark function, leading to arbitrary code execution. This vulnerability could potentially jeopardize the integrity of systems utilizing this software, making it crucial for users to apply appropriate patches and monitor their environments for any signs of malicious activity.

References

https://github.com/quickjs-ng/quickjs/issues/1400

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.