We no longer accept private security reports nor issue CVEs. Please file bug reports in the issue tracker.
Bytecode hardening is out of scope. QuickJS bytecode is not designed for
adversarial input. Loading untrusted bytecode (e.g. via JS_ReadObject with
JS_READ_OBJ_BYTECODE) is equivalent to executing untrusted native code, and
crashes, memory corruption, or sandbox escapes resulting from malformed or
malicious bytecode are not considered security vulnerabilities. Only load
bytecode you produced yourself or obtained from a trusted source. See the
documentation for JS_READ_OBJ_BYTECODE and JS_READ_OBJ_SAB for details.