Assertion Failure Vulnerability in QuickJS Package
Summary
UBUNTU-CVE-2024-33263: QuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime(JSRuntime *) at quickjs.c. Affects quickjs versions 2021.03.27-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight JavaScript engine that is designed to be embeddable in applications. It supports the ES2020 specification and is known for its small footprint and fast performance. The package is widely used in various applications that require JavaScript execution capabilities. However, a recent vulnerability has been identified that could lead to an assertion failure, potentially affecting the stability of applications using this package.
Vulnerability Detail
The vulnerability, identified as CVE-2024-33263, originates from a specific commit (3b45d15) in the QuickJS codebase. It manifests as an assertion failure when the function JS_FreeRuntime is called with a JSRuntime pointer. This could lead to unexpected behavior or crashes in applications that rely on QuickJS for JavaScript execution. The severity of this vulnerability is rated with a CVSS score of 4.0, indicating a medium risk level. If exploited, it could compromise the reliability of applications that utilize this engine.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function JS_FreeRuntime until they can apply the patch. This may involve modifying the application code to prevent calls to this function until the update is completed.
Conclusion
The QuickJS package has a vulnerability (CVE-2024-33263) that can lead to assertion failures, affecting application stability. Users are advised to update to the patched version to mitigate risks. Temporary workarounds are available, but applying the update is the best course of action.
See every vulnerability recorded for quickjs →
FAQ
CVE-2024-33263 is a vulnerability in the QuickJS package that leads to an assertion failure, potentially causing application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.0, indicating a medium risk level.
If you cannot update the package immediately, consider avoiding the use of the JS_FreeRuntime function as a temporary workaround.
More information about QuickJS can be found on its official GitHub repository and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
