CVE-2024-36120 javascript-deobfuscator crafted payload can lead to code execution
Attackers can execute arbitrary code via crafted payloads in the javascript-deobfuscator library, requiring users to upgrade or disable expression simplification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36120?
CVE-2024-36120 is a high-severity code injection vulnerability in ben-sb javascript-deobfuscator, published on 31 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.
Weakness: CWE-94
Which versions are affected by CVE-2024-36120?
2 open source packages ship an affected version, including js-deobfuscator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
js-deobfuscator npm | All versions | 1.1.0 |
js-deobfuscator npm | All versions | 1.1.0 |
Products include Deobfuscate Javascript Deobfuscator.
How do I fix CVE-2024-36120?
Upgrade js-deobfuscator to 1.1.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-36120 being exploited?
There is no known exploitation of CVE-2024-36120 in the wild and no public exploit code.
Sources
Also known as GHSA-9p6p-8v9r-8c9m.