javascript-deobfuscator crafted payload can lead to code execution

ÉLEVÉE 7.8CVE-2024-36120 · GHSA-9p6p-8v9r-8c9m · Published 31/05/2024 · updated 17/06/2026

En bref

CVE-2024-36120 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant javascript deobfuscator (deobfuscate), js-deobfuscator.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.35%, plus élevée que 28.7% des vulnérabilités.
Correctif : mettre à jour vers 1.1.0 ou plus récent.

Package	Affected versions	Patched versions
javascript deobfuscator deobfuscate	`< 1.1.0`	`1.1.0`
js-deobfuscator npm	`< 1.1.0`	`1.1.0`

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

NVD description

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

References

ben-sb/javascript-deobfuscator security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-36120 · ADVISORY
ben-sb/javascript-deobfuscator commit 630d3ca · WEB
ben-sb/javascript-deobfuscator · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free