js-vuln-db - A collection of JavaScript engine CVEs with PoCs

项目说明

Case Study of Ja Engine

V8

C | Feature | Keywords | Credit
---------- | ------- | -------- | ------
C | TypedArray | Integer O, OOB | _Pinkie Pie_
C | TypedArray | Invalid Array Length, OOB | _geohot_
C | Array.concat | Side Effect, OOB | _lokihardt_
C | Optimization | asm.js, OOB | _Christian Holler_
C | Optimization | Array | _Christian Holler_
C | Optimization | Array, OOB | ?
C | Optimization | Array, Type Confusion | _
C | JSON.stringify | Side Effect, OOB, | _Guang Gong [[1]](#qihoo360)_
C | TypedArray.map | Prototype, OOB | ?
C | JSON.stringify | Side Effect, OOB | ?
C | Array.concat | Side Effect, OOB | _Wen Xu [[2]](#keenlab)_
C | Optimization | asm.js, TypedArray, OOB | _Choongwoo Han [[6]](#kaistsoftsec)_
C | Optimization | asm.js | _HyungSeok Han [[6]](#kaistsoftsec)_
C | RegExp | Heap O, Integer O | _Choongwoo Han [[6]](#kaistsoftsec)_
C | decodeURI | Side Effect, Information Leak | _Guang Gong [[1]](#qihoo360)_
C | RegExp | | _Max Korenko_
C | Array | Side Effect | _Jeonghoon Shin_
C | Parser | Scope, eval | _Choongwoo Han [[6]](#kaistsoftsec)_
C | Optimization | parseInt, Compiler, OOB | _Tencent Keen Security Lab_
C | Optimization | asm.js TypedArray, OOB | _Choongwoo Han [[6]](#kaistsoftsec)_
C | Object.assign | Logic, Property | _Guang Gong [[1]](#qihoo360)_
C | Array.concat | Side Effect, OOB | _Brendon Tiszka_
C | Array.indexOf | TypedArray, Side Effect, Detach Buffer | _Choongwoo Han_
C | Array.indexOf | Side Effect | _Team Sniper [[2]](#keenlab)_
C | Optimization | Array, Type Confusion | _Zhao Qixun [[5]](#qihoo360)_
C | Compiler | OOB | _Choongwoo Han_
C | wasm | Information Leak | _Xiling Gong [[7]](#tencentplatform)_
C | Parser | Use After Free | _Jihoon Kim [[6]](#kaistsoftsec)_
C | Compiler | OOB | Marco Gio
C | wasm | Race Condition | _Guang Gong [[1]](#qihoo360)_
C | Compiler | Uninitialized Memory | _Jordan Rabet [[9]](#microsoft)_
C | wasm | OOB | _Choongwoo Han [[8]](#naver)_
C | wasm | Use After Free | _Zhao Qixun [[5]](#qihoo360)_
C | wasm | Side Effect, OOB | ?
C | Object | OOB | _lokihardt [[3]](#projectzero)_
C | wasm | Race Condition | _Guang Gong [[1]](#qihoo360)_
C | Object.entries | Side Effect, OOB | _lokihardt [[3]](#projectzero)_
C | Object | Integer O | _Mark Brand [[3]](#projectzero)_
C | wasm | Integer O | _Natalie Sil [[3]](#projectzero)_
C | async generator | Side Effect, Type Confusion | _lokihardt [[3]](#projectzero)_
C | wasm | async, Side Effect, Type Confusion | ?
C | RegExp | Side Effect, Type Confusion | _Peter Wong_
C | Map | Information Leak, OOB | _Choongwoo Han [[8]](#naver)_
C | RegExp | Side Effect, OOB | _Guang Gong [[1]](#qihoo360)_
C | String.split | Allocator, OOB | _Yu Zhou and Jundong Xie [[11]](#afly)_
C | TypedArray.of | Side Effect, OOB, Detach Buffer | _Brendon Tiszka_
C | Compiler | Object.create | _Samuel Gross_
C | Compiler | OOB | _Jay Bosamiya_
C | Compiler | OOB | _Zhao Qixun [[5]](#qihoo360)_
C | Optimization | Allocator | _lupin_

ChakraCore

C | Feature | Keywords | Credit
---------- | ------- | -------- | ------
C | Spread Operator | Array, Proxy, Stack O | _Richard Zhu_
C | Array.join | Information Leak | _Natalie Sil [[3]](#projectzero)_
C | Array.map | Heap O | _Natalie Sil [[3]](#projectzero)_
C | Function.apply | Information Leak | _Natalie Sil [[3]](#projectzero)_
C | Array.filter | Heap Corruption | _Natalie Sil [[3]](#projectzero)_
C | Array | Prototype, Type Confusion | _Natalie Sil [[3]](#projectzero)_
C | Array.reverse | O | _Natalie Sil [[3]](#projectzero)_
C | Array.splice | Heap O | _Natalie Sil [[3]](#projectzero)_
C | eval | Proxy, Type Confusion | _Natalie Sil [[3]](#projectzero)_
C | JSON.parse | Information Leak | _Natalie Sil [[3]](#projectzero)_
C | SIMD.toLocaleString | Uninitialized Memory | _Natalie Sil [[3]](#projectzero)_
C | Intl | Initialization, Type Confusion | _Natalie Sil [[3]](#projectzero)_
C | TypedArray.sort | Side Effect, Detach Buffer | _Natalie Sil [[3]](#projectzero)_
C | Spread Operator | Side Effect, Uninitialized Memory | _Qixun Zhao [[4]](#qihoo360skyeye)_<br/> _lokihart_<br/> _Simon Zuckerbraun_
C | Optimization | Array, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Array.concat | Side Effect, Type Confusion | _Jordan Rabet_
C | Array.reverse | Side Effect | _Semmle Inc_
C | ArrayBuffer | OOB | _Yuange [[10]](#zhanlulab)_
C | ArrayBuffer | UAF | _Tencent Security Lance Team_ <br/> _Yuki Chen [[5]](#qihoo360)_
C | Optimization | Array | _lokihardt [[3]](#projectzero)_
C | Optimization | Array | _lokihardt [[3]](#projectzero)_
C | Array.concat | Side Effect | _Hao Lian [[5]](#qihoo360)_<br/>_HyungSeok Han [[6]](#kaistsoftsec)_
C | Compiler | Integer O | _lokihardt [[3]](#projectzero)_
C | arguments, | Compiler, Uninitialize Memory | _lokihardt [[3]](#projectzero)_
C | Compiler | asm.js | _lokihardt [[3]](#projectzero)_
C | Compiler | asm.js | _lokihardt [[3]](#projectzero)_
C | try | Uninitialized Memory | _lokihardt [[3]](#projectzero)_
C | Compiler | asm.js | _lokihardt [[3]](#projectzero)_
C | arguments | Compiler, Uninitialize Memory | _lokihardt [[3]](#projectzero)_
C | Function.call | Integer O | _lokihardt [[3]](#projectzero)_
C | Parser | Object | _lokihardt [[3]](#projectzero)_
C | Parser | Scope | _lokihardt [[3]](#projectzero)_
C | Parser | asm.js | _lokihardt [[3]](#projectzero)_
C | Parser | eval | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | String.replace, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Uninitialized Memory | _lokihardt [[3]](#projectzero)_
C | Compiler | Type confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | Integer O | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Math | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | asm.js, OOB | _lokihardt [[3]](#projectzero)_
C | Compiler | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | String | Integer O | _lokihardt [[3]](#projectzero)_
C | Array | OOB | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, OOB | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | Incorrect Scope | _lokihardt [[3]](#projectzero)_
C | Compiler | Incorrect Scope | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Bailout | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | asm.js, OOB | _lokihardt [[3]](#projectzero)_
C | Compiler | Array, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Array.reverse, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Array, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Information Leak | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Bailout | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT, Bailout | _lokihardt [[3]](#projectzero)_
C | Compiler | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Bound Check Elimination | _lokihardt [[3]](#projectzero)_
C | Function | OOB | _lokihardt [[3]](#projectzero)_
C | JIT | OOB | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Parser | Parameter Scope | _lokihardt [[3]](#projectzero)_
C | Compiler | JIT | _lokihardt [[3]](#projectzero)_
C | Property | Type confusion | _lokihardt [[3]](#projectzero)_
C | Intl | TimeFormat | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | PathTypeHandler | Type Confusion | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Optimization | Type Confusion | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | JIT | Type Confusion | _lokihardt [[3]](#projectzero)_
C | JIT | Use After Free | _lokihardt [[3]](#projectzero)_

Ja

C | Feature | Keywords | Credit
---------- | ------- | -------- | ------
C | Array.join | Side Effect, Use After Free | _Liang Chen_, _Zhen Feng_, _wushi_ _[[2]](#keenlab)_<br/> _Jeonghoon Shin_
C | Array.slice | Side Effect, OOB | _Samuel Groß_
C | TypedArray.copyWithin<br/> TypedArray.fill | Side Effect, Detach Buffer | _Natalie Sil [[3]](#projectzero)_
C | Funciton.caller | Type Confusion | _Natalie Sil [[3]](#projectzero)_
C | Function.bind | OOB | _Natalie Sil [[3]](#projectzero)_
C | Array.concat | Integer O | _Natalie Sil [[3]](#projectzero)_
C | String.replace | RegExp, Use After Free | _Samuel Groß_, and _Niklas Baumstark_
C | Array.length | OOB | _lokihardt [[3]](#projectzero)_
C | | OOB | _lokihardt [[3]](#projectzero)_
C | Spread Operator | Array, Integer O | _Samuel Groß_, and _Niklas Baumstark_
C | Optimization | parseInt, Compiler, OOB | _lokihardt [[3]](#projectzero)_
C | Array.splice | Uninitialized Memory | _lokihardt [[3]](#projectzero)_
C | Intl.getCanonicalLocales | Heap O | _lokihardt [[3]](#projectzero)_
C | arguments | Uninitialized Memory | _lokihardt [[3]](#projectzero)_
C | Compiler | for-in, Type Confusion | _lokihardt [[3]](#projectzero)_
C | String.link | Heap O | _Samuel Groß and Niklas Baumstark_<br>_Qixun Zhao [[5]](#qihoo360)_
C | Compiler | for-in, Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Proxy, Array, Type Confusion | _Samuel Groß_
C | Compiler | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Incorrect Optimization | _lokihardt [[3]](#projectzero)_
C | Compiler | Type Confusion | _lokihardt [[3]](#projectzero)_
C | Compiler | Prototype Chains | _lokihardt [[3]](#projectzero)_
C | JSArray | OOB | _lokihardt [[3]](#projectzero)_
C | JIT | Use After Free | _lokihardt [[3]](#projectzero)_
C | AbstractValue | Use After Free | _lokihardt [[3]](#projectzero)_
C | Optimization | Type Confusion | _lokihardt [[3]](#projectzero)_
C | RegExp | Type Confusion | _Samuel Groß [[3]](#projectzero)_
C | JIT | OOB | _Samuel Groß [[3]](#projectzero)_
C | CodeBlock | UAF | _Samuel Groß [[3]](#projectzero)_

SpiderMonkey

C | Feature | Keywords | Credit
---------- | ------- | -------- | ------
C | TypedArray.subarray | OOB, Detach Buffer, Side Effect | _Jüri Aedla_
C | Array.prototype.push | Memory Disclosure | _Bruno Keith and Niklas Baumstark_
C | OSR, JIT | Type Confusions | _Samuel Groß [[3]](#projectzero)_
C | Prototype, JIT | Type Confusions | _Samuel Groß [[3]](#projectzero)_

JScript

C | Feature | Keywords | Credit
---------- | ------- | -------- | ------
C | JSON | Use After Free | _ifratric [[3]](#projectzero)_
C | Array.slice | Uninitialized | _ifratric [[3]](#projectzero)_
C | RegExp | Heap o | _ifratric [[3]](#projectzero)_
C | Array.join | Use After Free | _ifratric [[3]](#projectzero)_
C | RegExp | OOB | _ifratric [[3]](#projectzero)_
C | Array.sort | Heap o | _ifratric [[3]](#projectzero)_
C | RegExp.lastMatch | Memory Disclosure | _ifratric [[3]](#projectzero)_
C | Array | Use After Free | _ifratric [[3]](#projectzero)_
C | RegExp | Use After Free | _ifratric [[3]](#projectzero)_
C | Array | OOB | _ifratric [[3]](#projectzero)_
C | Acti | Use After Free | _Sudhakar Verma and Ashfaq Ansari[[12]](#srishti)_
C | get | Use After Free | _Krishnakant Patil and Siddhant Badhe[[12]](#srishti)_

---
<a name="qihoo360"></a>[1] Qihoo 360
<a name="keenlab"></a>[2] Tencent KeenLab
<a name="projectzero"></a>[3] Google Project Zero
<a name="qihoo360skyeye"></a>[4] Qihoo 360 Skyeye Labs
<a name="qihoo360"></a>[5] Qihoo 360 Team
<a name="kaistsoftsec"></a>[6] KAIST SoftSec
<a name="tencentplatform"></a>[7] Tencent Security Platform Department
<a name="naver"></a>[8] Na
<a name="microsoft"></a>[9] Microsoft
<a name="zhanlulab"></a>[10] Tencent Zhanlu Lab
<a name="afly"></a>[11] Ant-financial Light-Year Security Lab
<a name="srishti"></a>[12] Project Srishti

项目信息

开发语言：未知

Star 数：2320

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of JavaScript engine CVEs with PoCs展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。