CSSA Exclusive Early Warning9.8 Critical
QuickJS out-of-bounds write triggered by malformed bytecode leading to heap corruption and service disruption
The vulnerability originates in a sign extension defect in the bytecode deserialization function when parsing the closure variable count field. An attacker can craft maliciously serialized bytecode input to trigger a signed integer overflow, causing the subsequent memory allocation calculation to shrink abnormally. Once the host environment reads this malformed data through the public deserialization interface, the underlying heap allocator requests an undersized region, and an out-of-bounds write then occurs while populating the function header structure and performing the memory copy. The defect is network-reachable and requires no authentication; successful exploitation directly corrupts the process heap layout, crashing the target service or creating the risk of control flow hijacking.
Component
QuickJS is a lightweight, embeddable JavaScript engine with a single-file architecture conforming to the ECMAScript specification. Its core capabiliti…
Type
Out-of-bounds Write (CWE-787)
Repo
Remediation- It is recommended that developers enforce strict boundary validation when parsing external data structures, handle length and count fields uniformly as unsigned types, and add overflow detection before performing allocation arithmetic. Safe integer conversion functions should replace implicit type coercion, ensuring the allocation request matches the actual write requirement and eliminating out-of-bounds access caused by arithmetic wraparound at its root.
CSSA Exclusive Early Warning9.8 Critical
MetaMCP privilege-exceeding read and write of OAuth credentials leading to impersonation of upstream services
The defect stems from the front-end routing layer omitting the context user identifier field when passing parameters to the underlying implementation, causing database query logic to trust the attacker-supplied resource identifier directly and skip ownership verification. An attacker holding only a valid session credential can craft malicious requests over the network interface, enumerating or predicting target server identifiers to trigger privilege-exceeding read and overwrite operations. This failure of the security boundary directly exposes sensitive authorization credentials, letting an attacker impersonate identities on third-party platforms with stolen access tokens, maintain long-term illegitimate access through refresh tokens, or disrupt service for legitimate users by tampering with credentials. The threat spans all tenant data assets within a shared deployment.
Component
MetaMCP is a centralized authentication and management platform for multi-protocol collaboration. Its architecture separates front end from back end a…
Type
Authorization Bypass Through User-Controlled Key (CWE-639)
Repo
Remediation- It is recommended that the development team review the entire data access path and enforce strict ownership validation based on user context. An indirect reference mapping table should be maintained independently on the server side, eliminating direct client submission of raw identifiers. Least privilege should be applied throughout, with automated authorization interception testing for every interface involving sensitive state changes, ensuring the business logic layer always filters query scope dynamically by current session identity and removing privilege-exceeding access at the architectural level.
