RCE in Ben-Sb Javascript-Deobfuscator
CVE-2024-36120
javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.003 (27.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Ben-sb Javascript-deobfuscator — versions < 1.1.0
- Deobfuscate Javascript_deobfuscator
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-36120?
- CVE-2024-36120 is a high-severity vulnerability in Ben-Sb Javascript-Deobfuscator, classified under Code Injection. CVSS score: 8.1/10. Published 2024-05-31.
- How severe is CVE-2024-36120?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2024-36120 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.