javascript-deobfuscator crafted payload can lead to code execution

높음 7.8CVE-2024-36120 · GHSA-9p6p-8v9r-8c9m · Published 31/05/2024 · updated 17/06/2026

요약

CVE-2024-36120은(는) javascript deobfuscator (deobfuscate), js-deobfuscator에 영향을 주는 높음 (CVSS 7.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.35%, 전체 취약점의 28.7%보다 높음.
조치: 1.1.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
javascript deobfuscator deobfuscate	`< 1.1.0`	`1.1.0`
js-deobfuscator npm	`< 1.1.0`	`1.1.0`

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

NVD description

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

References

ben-sb/javascript-deobfuscator security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-36120 · ADVISORY
ben-sb/javascript-deobfuscator commit 630d3ca · WEB
ben-sb/javascript-deobfuscator · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free