From 4da05a7076ff657457ada5c5e8fdee6a978e4b0e Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 28 Jan 2026 14:29:22 -0800
Subject: [PATCH] quickjs: mark vulnerable for CVE-2026-1144, CVE-2026-1145

These vulnerabilities affect quickjs 2025-09-13-2 and earlier:

- CVE-2026-1144: use-after-free in Atomics Ops Handler
- CVE-2026-1145: heap-based buffer overflow in js_typed_array_constructor_ta

Upstream fix is pending: https://github.com/bellard/quickjs/pull/483

Once the PR is merged and a new release is available, this package
should be updated and the knownVulnerabilities removed.
---
 pkgs/by-name/qu/quickjs/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index 753362a301d6..e471f16b0d15 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -121,5 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ ];
     mainProgram = "qjs";
     platforms = lib.platforms.all;
+    # Pending upstream fix: https://github.com/bellard/quickjs/pull/483
+    knownVulnerabilities = [
+      "CVE-2026-1144"
+      "CVE-2026-1145"
+    ];
   };
 })