javascript-deobfuscator crafted payload can lead to code execution

HIGH 7.8CVE-2024-36120 · GHSA-9p6p-8v9r-8c9m · Published 31/05/2024 · updated 17/06/2026

In short

CVE-2024-36120 is a HIGH (CVSS 7.8) vulnerability affecting javascript deobfuscator (deobfuscate), js-deobfuscator.
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.7% of all vulnerabilities.
Fix: update to 1.1.0 or later.

Package	Affected versions	Patched versions
javascript deobfuscator deobfuscate	`< 1.1.0`	`1.1.0`
js-deobfuscator npm	`< 1.1.0`	`1.1.0`

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

NVD description

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

References

ben-sb/javascript-deobfuscator security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-36120 · ADVISORY
ben-sb/javascript-deobfuscator commit 630d3ca · WEB
ben-sb/javascript-deobfuscator · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free