Code Injection Affecting js-deobfuscator package, versions <1.1.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSDEOBFUSCATOR-7176000
- published 2 Jun 2024
- disclosed 31 May 2024
- credit SteakEnthusiast
Introduced: 31 May 2024
CVE-2024-36120 Open this link in a new tabHow to fix?
Upgrade js-deobfuscator to version 1.1.0 or higher.
Overview
js-deobfuscator is an A simple but powerful deobfuscator to remove common JavaScript obfuscation techniques. Open an issue if there is a feature you think should be implemented.
Affected versions of this package are vulnerable to Code Injection through crafted payloads targeting expression simplification. An attacker can execute arbitrary code by exploiting improperly handled input in the expression simplification feature.
Workaround
This vulnerability can be mitigated by disabling the expression simplification feature.