CVE-2026-1245 CVE-2026-1245
Attackers can execute arbitrary JavaScript code via unsanitized parser field names or encoding parameters in the binary-parser library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1245?
CVE-2026-1245 is a medium-severity code injection vulnerability in binary-parser, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.
Weakness: CWE-94
Which versions are affected by CVE-2026-1245?
2 open source packages ship an affected version, including binary-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
binary-parser npm | All versions | 2.3.0 |
binary-parser npm | All versions | 2.3.0 |
Products include Keichi Binary-Parser.
How do I fix CVE-2026-1245?
Upgrade binary-parser to 2.3.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-1245 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1245 exists.
Sources
Also known as GHSA-m39p-34qh-rh3w.