Lucene search

GitHub Advisory DatabaseGHSA-9P6P-8V9R-8C9M

HistoryJun 04, 2024 - 3:13 p.m.

javascript-deobfuscator crafted payload can lead to code execution

2024-06-0415:13:54

CWE-94

GitHub Advisory Database

github.com

javascript

deobfuscator

code execution

patched

8.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

Affected configurations

Vulners

Node

jsdeobfuscatorRange<1.1.0

CPENameOperatorVersion
js-deobfuscatorlt1.1.0

CPE	Name	Operator	Version
	js-deobfuscator	lt	1.1.0

References

github.com/advisories/GHSA-9p6p-8v9r-8c9m

github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6

github.com/ben-sb/javascript-deobfuscator/security/advisories/GHSA-9p6p-8v9r-8c9m

nvd.nist.gov/vuln/detail/CVE-2024-36120

8.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for GHSA-9P6P-8V9R-8C9M