Code Injection Flaw in `binary-parser` Enables Remote Code Execution

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Vulnerabilities

1 linked

Code Injection in binary-parser (CVE-2026-1245)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Csirt SkNews · Jan 22, 2026

Zraniteľnosť NPM knižnice Binary-Parser umožňuje vzdialené vykonanie kódu | CSIRT.SKOpen source ↗

Cert Cc Security AdvisoriesAdvisories

VU#102648 - Code Injection Vulnerability in binary-parser libraryOpen source ↗

On the same thread

A code-injection vulnerability in the Node.js npm package **binary-parser** can allow attackers to execute arbitrary JavaScript when applications build parser definitions from **untrusted input**. Tracked as **CVE-2026-1245**, the issue affects **binary-parser versions < 2.3.0** and stems from the library’s use of dynamic code generation: it constructs JavaScript source at runtime and compiles it using the `Function` constructor for performance. CERT/CC and third-party reporting indicate the flaw occurs because **user-supplied values**—notably **parser field names** and **encoding parameters**—can be incorporated into the generated code **without sanitization**, enabling attacker-controlled modification of the resulting executable parser logic. Impact depends on how the library is used: applications with **static, hard-coded** parser definitions are not affected, but implementations that allow external input to influence parser structure (e.g., user-defined parsing of uploaded content) may enable code execution with the **privileges of the Node.js process**; upgrading to **2.3.0** is the primary remediation, with patches noted as released **November 26, 2025**.

Jan 21, 2026

Multiple Node.js Admin Tools Exposed to Remote Code Execution Flaws

Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.

Jun 5, 2026

Critical Remote Code Execution Vulnerability in Happy DOM JavaScript Library

A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.

Oct 14, 2025

Code Injection Flaw in `binary-parser` Enables Remote Code Execution

How this story unfolded

binary-parser 2.3.0 released to fix CVE-2026-1245

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Code Injection Flaw in `binary-parser` Enables Remote Code Execution

How this story unfolded

binary-parser 2.3.0 released to fix CVE-2026-1245

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Code Injection Flaw in `binary-parser` Enables Remote Code Execution

How this story unfolded

binary-parser 2.3.0 released to fix CVE-2026-1245

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

CVE-2026-1245 Code Injection in Node.js *binary-parser* via Dynamic Function Generation

Multiple Node.js Admin Tools Exposed to Remote Code Execution Flaws

Critical Remote Code Execution Vulnerability in Happy DOM JavaScript Library

Code Injection Flaw in `binary-parser` Enables Remote Code Execution

How this story unfolded

binary-parser 2.3.0 released to fix CVE-2026-1245

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

CVE-2026-1245 Code Injection in Node.js *binary-parser* via Dynamic Function Generation

Multiple Node.js Admin Tools Exposed to Remote Code Execution Flaws

Critical Remote Code Execution Vulnerability in Happy DOM JavaScript Library

CVE-2026-1245 Code Injection in Node.js binary-parser via Dynamic Function Generation

CVE-2026-1245 Code Injection in Node.js binary-parser via Dynamic Function Generation