GitHub Advisoryadvisory · npm

GHSA-m39p-34qh-rh3w binary-parser library has a code injection vulnerability

MEDIUM Published 2026-01-20 Modified 2026-01-21 Official page ↗
Aliases
CVE-2026-1245
Ecosystem
npm
Packages
binary-parser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-94
Reviewed
2026-01-21

Affected packages

• npm binary-parser: < 2.3.0 → fixed in 2.3.0

Description

A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.

Related

Alias · CVE (1)

  • CVE-2026-1245 A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References