High severity - Code Injection vulnerability in js-deobfuscator (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: js-deobfuscator
• Introduced through: goof@1.0.1 and js-deobfuscator@1.0.14

Detailed paths

• Introduced through: goof@1.0.1 › js-deobfuscator@1.0.14

Overview

js-deobfuscator is an A simple but powerful deobfuscator to remove common JavaScript obfuscation techniques. Open an issue if there is a feature you think should be implemented.

Affected versions of this package are vulnerable to Code Injection through crafted payloads targeting expression simplification. An attacker can execute arbitrary code by exploiting improperly handled input in the expression simplification feature.

Workaround

This vulnerability can be mitigated by disabling the expression simplification feature.

Remediation

Upgrade js-deobfuscator to version 1.1.0 or higher.

References

• GitHub Commit
  
  SNYK-JS-JSDEOBFUSCATOR-7176000
  (CVE-2024-36120) js-deobfuscator@1.0.14