This vulnerability in QuickJS-NG v0.12.1 involves the js_mapped_arguments_mark function, which can be exploited by an attacker to execute arbitrary code. The issue is related to CWE-94 (Improper Control of Generation of Code), allowing code injection or execution. The CVSS 3.1 base score of 7.3 indicates a high-severity flaw with network attack vector, no required privileges or user interaction, and impacts on confidentiality, integrity, and availability. No official remediation or patch has been disclosed, and no exploits are known in the wild at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code remotely, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system running QuickJS-NG 0.12.1. However, no known exploits have been reported in the wild, and the extent of impact depends on the deployment context of QuickJS-NG.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network exposure of QuickJS-NG instances and monitor for updates from the vendor or project maintainers. No official mitigation or workaround has been documented.