cve.bz

CVE-2024-36120

7.8 highEPSS 0.3%

High (7.8) in deobfuscate javascript deobfuscator. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in js-deobfuscator 1.1.0.

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.

Severity

CVSS 3.1

7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE
CWE-94
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9p6p-8v9r-8c9mnpmjs-deobfuscator<1.1.01.1.0

References

Check your stackJSON