QuickJS — Vulnerabilities & Security Advisories 7

QuickJS is a lightweight JavaScript engine designed for embedding in applications and running JavaScript code in resource-constrained environments. Historically, it has been vulnerable to memory corruption issues, including use-after-free and buffer overflow flaws, which have led to several remote code execution vulnerabilities. Cross-site scripting (XSS) vulnerabilities have also been identified due to improper input sanitization. While no major public security incidents have been widely reported, the 7 CVEs on record highlight ongoing concerns around memory safety and input validation. Its small codebase reduces attack surface compared to larger engines, but developers must remain vigilant about memory management and sandboxing when implementing QuickJS in security-sensitive contexts.