javascript-deobfuscator crafted payload can lead to code execution

ALTO 7.8CVE-2024-36120 · GHSA-9p6p-8v9r-8c9m · Published 31/05/2024 · updated 17/06/2026

En resumen

CVE-2024-36120 es una vulnerabilidad ALTO (CVSS 7.8) que afecta a javascript deobfuscator (deobfuscate), js-deobfuscator.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.35%, mayor que el 28.7% de las vulnerabilidades.
Solución: actualizar a 1.1.0 o posterior.

Package	Affected versions	Patched versions
javascript deobfuscator deobfuscate	`< 1.1.0`	`1.1.0`
js-deobfuscator npm	`< 1.1.0`	`1.1.0`

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

NVD description

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

References

ben-sb/javascript-deobfuscator security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-36120 · ADVISORY
ben-sb/javascript-deobfuscator commit 630d3ca · WEB
ben-sb/javascript-deobfuscator · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free