CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-45811
High (7.8) in relative synchrony. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in deobfuscator 2.4.4.
Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- relative:synchrony
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jg82-xh3w-rhxx | npm | deobfuscator | >=2.0.1 <2.4.4 | 2.4.4 |
References
- https://github.com/relative/synchrony/commit/b583126be94c4db7c5a478f1c5204bfb4162cf40
- https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx
- https://github.com/relative/synchrony/security/advisories/src/transformers/literalmap.ts
- https://github.com/relative/synchrony/commit/b583126be94c4db7c5a478f1c5204bfb4162cf40
- https://github.com/relative/synchrony/security/advisories/GHSA-jg82-xh3w-rhxx