javascript-deobfuscator crafted payload can lead to code execution

HOCH 7.8CVE-2024-36120 · GHSA-9p6p-8v9r-8c9m · Published 31/05/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-36120 ist eine Schwachstelle (HOCH (CVSS 7.8)) in javascript deobfuscator (deobfuscate), js-deobfuscator.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.35%, höher als bei 28.7% aller Schwachstellen.
Abhilfe: auf 1.1.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
javascript deobfuscator deobfuscate	`< 1.1.0`	`1.1.0`
js-deobfuscator npm	`< 1.1.0`	`1.1.0`

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

NVD description

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

References

ben-sb/javascript-deobfuscator security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-36120 · ADVISORY
ben-sb/javascript-deobfuscator commit 630d3ca · WEB
ben-sb/javascript-deobfuscator · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free