CVE-2024-36120: javascript-deobfuscator crafted payload can lead to code execution

June 4, 2024

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

References

github.com/advisories/GHSA-9p6p-8v9r-8c9m
github.com/ben-sb/javascript-deobfuscator
github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6
github.com/ben-sb/javascript-deobfuscator/security/advisories/GHSA-9p6p-8v9r-8c9m
nvd.nist.gov/vuln/detail/CVE-2024-36120

Code Behaviors & Features

Detect and mitigate CVE-2024-36120 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →