CVE-2023-48183: 
NixOS vulnerability analysis and mitigation

QuickJS before commit c4cdd61 contains a NULL pointer dereference vulnerability in the build_for_in_iterator function due to an erroneous lexical scope handling of 'this' with eval. The vulnerability is tracked as CVE-2023-48183 (GitHub Issue).

The vulnerability occurs in the build_for_in_iterator function where p = JS_VALUE_GET_OBJ(obj) returns 0, leading to a NULL pointer dereference. The root cause is related to eval appearing in a function causing it to close over 'this', but not maintaining the proper is_lexical status. This happens because the code fails to properly handle the lexical scope when eval is used in combination with 'this' references (GitHub Commit).

When exploited, this vulnerability can cause the application to crash due to the NULL pointer dereference, potentially leading to a denial of service condition.

The vulnerability can be triggered by specific JavaScript code patterns that combine class constructors, eval statements, and for-in loops accessing 'this'. A proof-of-concept exploit has been demonstrated using a test case involving a class constructor with an arrow function containing a for-in loop and eval statement (GitHub Issue).

The vulnerability has been fixed in commit c4cdd61 by correcting the lexical scope handling of 'this' with eval. Users should upgrade to a version of QuickJS that includes this commit (GitHub Commit).