javascript-deobfuscator crafted payload can lead to code execution

Description

javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.

Recommendation

Update the js-deobfuscator package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.0
• Patched version(s): 1.1.0

References

• GHSA-9p6p-8v9r-8c9m
• CVE-2024-36120
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Happy DOM: VM Context Escape can lead to Remote Code Execution - CVE-2025-61927
• Pug allows JavaScript code execution if an application accepts untrusted input - CVE-2024-36361
• Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader - CVE-2026-53597
• dom-iterator code execution vulnerability - CVE-2024-21541

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

js-deobfuscator