CVE-2024-13903

What it actually does

Stack-based buffer overflow triggered in the JS_GetRuntime function within quickjs.c of the qjs component when handling manipulated input.

Why it matters to the business

Remote attackers could crash the process or execute arbitrary code, leading to service disruption or compromise in any application embedding this JavaScript engine; prevalence in downstream projects increases exposure surface across development and runtime environments.

How an attack unfolds

An attacker crafts malicious input and sends it remotely to a vulnerable QuickJS instance; the input reaches JS_GetRuntime, overflows the stack buffer, and allows control-flow hijacking or denial of service.

How to fix it

Upgrade quickjs-ng/quickjs to version 0.9.0 or apply commit 99c02eb45170775a9a679c32b45dd4000ea67aff (or the listed equivalent fixed commit 670492dd342dace0bb7bd6fbfbde8f0bc5651224).

How to confirm the fix worked

Confirm the installed QuickJS version is 0.9.0 or newer; verify the patch commit is present in the source; recompile and test that JS_GetRuntime no longer overflows on the original malformed input.

Typical attack path

1. Identify a remotely reachable service or binary using vulnerable QuickJS <= 0.8.0
2. Craft and transmit input that manipulates parameters to JS_GetRuntime
3. Trigger the stack-based overflow to corrupt return addresses or adjacent stack data
4. Achieve code execution or application crash

How to detect it

Review application logs and crash dumps for unexpected terminations or stack corruption around QuickJS runtime calls; inspect network traffic for unusual payloads targeting JavaScript evaluation endpoints.

What your security team should do

• Immediately upgrade all instances of quickjs-ng/quickjs to the fixed version
• Scan build pipelines and dependency manifests for references to QuickJS <= 0.8.0
• Add version pinning and automated dependency checks to prevent reintroduction
• Monitor upstream QuickJS releases for any follow-on security updates