CVE-2024-36120CWE-94

javascript-deobfuscator crafted payload can lead to code execution

High · published May 31, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-05-31T16:29Z
EPSS history
Timeline
  • 31 MAY 16:29Z
    javascript-deobfuscator crafted payload can lead to code execution
    cvelistv5