VDB
Sign up
MEDIUM6.5

GHSA-m39p-34qh-rh3w

binary-parser library has a code injection vulnerability

Quick fix

GHSA-m39p-34qh-rh3w — binary-parser: upgrade to the fixed version with the command below.

npm install binary-parser@2.3.0

Details

A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/binary-parser
Introduced in: 0Fixed in: 2.3.0
Fixnpm install binary-parser@2.3.0

References