CVE-2026-37630 Overview
CVE-2026-37630 is a code execution vulnerability in QuickJS-NG version 0.12.1, a lightweight JavaScript engine. The flaw resides in the js_mapped_arguments_mark function and allows an attacker to execute arbitrary code. The issue is classified under CWE-94 (Improper Control of Generation of Code). Because QuickJS-NG is commonly embedded in applications that evaluate untrusted JavaScript, exploitation can occur over the network without authentication or user interaction.
Critical Impact
Attackers who can supply JavaScript to an application embedding QuickJS-NG 0.12.1 can trigger arbitrary code execution through the js_mapped_arguments_mark function.
Affected Products
- QuickJS-NG JavaScript engine version 0.12.1
- Applications and runtimes embedding QuickJS-NG 0.12.1 as a scripting component
- Downstream projects that bundle the vulnerable QuickJS-NG release
Discovery Timeline
- 2026-05-11 - CVE-2026-37630 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-37630
Vulnerability Analysis
The vulnerability affects the js_mapped_arguments_mark function inside QuickJS-NG 0.12.1. This function participates in the garbage collector marking phase for mapped arguments objects, which tie function parameters to a backing array of values. The flaw permits an attacker to influence execution flow and run arbitrary code in the context of the host process embedding the engine.
QuickJS-NG is a community fork of QuickJS used in embedded environments, command-line interpreters, and applications that sandbox user-supplied JavaScript. A code execution defect in the engine breaks the sandbox boundary between untrusted scripts and the host application. The attack vector is network-based with low complexity, requiring neither privileges nor user interaction.
Further technical context is available in the QuickJS-NG GitHub Issue Discussion.
Root Cause
The root cause is improper control over generated code during marking of mapped arguments objects [CWE-94]. The js_mapped_arguments_mark routine handles object state in a way that an attacker-controlled script can leverage to corrupt engine internals and divert control flow. Once internal structures are manipulated, the attacker can achieve arbitrary code execution within the embedding process.
Attack Vector
An attacker delivers a crafted JavaScript payload to any application or service that evaluates it using QuickJS-NG 0.12.1. The payload exercises the mapped arguments object handling so that garbage collector marking interacts with attacker-influenced state. Triggering the flaw requires only the ability to submit JavaScript, which is common in web backends, IoT firmware, plugin systems, and serverless runtimes that embed the engine.
No verified proof-of-concept code has been published. Refer to the QuickJS-NG Issue 1400 for reproduction details from the upstream discussion.
Detection Methods for CVE-2026-37630
Indicators of Compromise
- Unexpected child processes spawned by binaries that embed QuickJS-NG, particularly shells or network utilities.
- Crashes or abnormal terminations in processes linked against libquickjs or the qjs interpreter when handling user-supplied scripts.
- Outbound network connections initiated from JavaScript runtime processes that normally do not perform network I/O.
Detection Strategies
- Inventory all applications and container images that embed QuickJS-NG and verify the bundled version against 0.12.1.
- Inspect application logs for script evaluation failures, segmentation faults, or garbage collector errors that may indicate exploitation attempts.
- Apply runtime behavioral monitoring on hosts that execute JavaScript from untrusted sources to flag anomalous process or file activity.
Monitoring Recommendations
- Enable verbose logging in JavaScript evaluation paths and forward logs to a centralized analytics platform for review.
- Alert on process lineage anomalies where a JavaScript runtime spawns interpreters, compilers, or system utilities.
- Monitor file integrity for binaries containing QuickJS-NG to confirm patched versions remain deployed.
How to Mitigate CVE-2026-37630
Immediate Actions Required
- Identify every system, container, and product that ships QuickJS-NG 0.12.1 and prioritize remediation on internet-facing services.
- Restrict the ability of untrusted users to submit JavaScript to applications backed by the vulnerable engine.
- Track the upstream QuickJS-NG Issue 1400 for the official fix and apply it once released.
Patch Information
At the time of publication, no fixed version is recorded in the NVD entry. Monitor the QuickJS-NG repository for a release that addresses the js_mapped_arguments_mark defect and rebuild dependent applications against the patched library. Vendors that distribute software embedding QuickJS-NG should issue updated builds once the upstream patch lands.
Workarounds
- Disable or gate features that evaluate untrusted JavaScript with QuickJS-NG until a fixed release is available.
- Run the JavaScript runtime in a least-privilege sandbox such as a seccomp-restricted container or dedicated unprivileged user.
- Enforce strict input validation and size limits on scripts accepted from external sources to reduce the exposure surface.
# Configuration example: confirm the installed QuickJS-NG version
qjs --version
# Expected output for vulnerable build: 0.12.1
# Example: run the interpreter under a restricted user with no network capability
sudo -u qjs-sandbox /usr/bin/firejail --net=none --private /usr/local/bin/qjs untrusted.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
