Loading story…
A code-injection vulnerability in the Node.js npm package binary-parser can allow attackers to execute arbitrary JavaScript when applications build parser definitions from untrusted input. Tracked as CVE-2026-1245, the issue affects binary-parser versions < 2.3.0 and stems from the library’s use of dynamic code generation: it constructs JavaScript source at runtime and compiles it using the Function constructor for performance.
CERT/CC and third-party reporting indicate the flaw occurs because user-supplied values—notably parser field names and encoding parameters—can be incorporated into the generated code without sanitization, enabling attacker-controlled modification of the resulting executable parser logic. Impact depends on how the library is used: applications with static, hard-coded parser definitions are not affected, but implementations that allow external input to influence parser structure (e.g., user-defined parsing of uploaded content) may enable code execution with the privileges of the Node.js process; upgrading to 2.3.0 is the primary remediation, with patches noted as released November 26, 2025.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT/CC published an advisory for CVE-2026-1245, warning that applications which build parser definitions from untrusted input could allow arbitrary JavaScript execution in the Node.js process context. The advisory noted that static, hard-coded parser definitions are not affected and urged users to upgrade.
Maintainer Keichi Takahashi patched the vulnerability in binary-parser version 2.3.0. The fix addressed insufficient sanitization of parser field names and encoding parameters that could lead to arbitrary JavaScript execution.
Security researcher Maor Caplan identified a code-injection vulnerability in the Node.js binary-parser library caused by unsafe incorporation of user-controlled values into dynamically generated JavaScript.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-1245** was disclosed in the npm binary data parsing library **`binary-parser`**, allowing remote unauthenticated attackers to inject and execute arbitrary JavaScript within a Node.js process. CERT/CC assigned the issue **VU#102648**, and CSIRT.SK reported that the flaw stems from insufficient validation of user-controlled field names and encoding parameters that are incorporated into dynamically generated JavaScript code.
Jul 24, 2026
A critical sandbox-escape flaw in the Node.js library **vm2** allows attackers to bypass protections around `Promise.prototype.then` and `Promise.prototype.catch`, break out of the sandbox, and execute arbitrary code on the host. The vulnerability, tracked as **`CVE-2026-22709`** with a **CVSS 9.8** score, affects **vm2 3.10.0 and earlier** and strikes at the library’s core purpose of safely running untrusted JavaScript. Users were urged to upgrade immediately to **`vm2` 3.10.2** or later. The disclosure follows broader concerns about vm2’s long-term viability after repeated sandbox escapes and a prior GitHub advisory describing additional flaws that could lead to remote code execution. Semgrep reported that the project was later discontinued after maintainers concluded vm2’s dependence on Node’s `vm` module and JavaScript proxy behavior made the sandboxing model fundamentally difficult to secure. The maintainer recommended **isolated-vm** as an alternative, while warning signs around maintenance and ecosystem support continue to raise risk for organizations that rely on JavaScript sandboxing libraries.
Jul 24, 2026
A critical vulnerability has been identified in the `systeminformation` library for Node.js, specifically affecting Windows systems. The flaw, tracked as CVE-2025-68154, resides in the `fsSize()` function, which fails to properly sanitize the `drive` parameter before concatenating it into a PowerShell command. This oversight allows for OS command injection, enabling attackers to execute arbitrary commands on affected systems if user-controlled input is passed to the vulnerable function. The issue is particularly concerning given the library's widespread use, with over 16 million monthly users potentially at risk. The vulnerability is remotely exploitable and has been addressed in version 5.27.14 of the library. Security researchers emphasize that the actual risk depends on how applications utilize the `fsSize()` function; if user input is not passed to this function, the risk is mitigated. Organizations using the `systeminformation` library on Windows are strongly advised to update to the patched version immediately to prevent exploitation and potential compromise of their systems.
Jun 29, 2026