Lucene search

GoogleOSV:GHSA-9P6P-8V9R-8C9M

HistoryJun 04, 2024 - 3:13 p.m.

javascript-deobfuscator crafted payload can lead to code execution

2024-06-0415:13:54

Google

osv.dev

security

javascript

deobfuscator

code execution

vulnerability

patched

8.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

CPENameOperatorVersion
js-deobfuscatorlt1.1.0

CPE	Name	Operator	Version
	js-deobfuscator	lt	1.1.0

References

github.com/ben-sb/javascript-deobfuscator

github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6

github.com/ben-sb/javascript-deobfuscator/security/advisories/GHSA-9p6p-8v9r-8c9m

nvd.nist.gov/vuln/detail/CVE-2024-36120

8.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for OSV:GHSA-9P6P-8V9R-8C9M