Loading story…
A critical vulnerability tracked as CVE-2026-1245 was disclosed in the npm binary data parsing library binary-parser, allowing remote unauthenticated attackers to inject and execute arbitrary JavaScript within a Node.js process. CERT/CC assigned the issue VU#102648, and CSIRT.SK reported that the flaw stems from insufficient validation of user-controlled field names and encoding parameters that are incorporated into dynamically generated JavaScript code.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A critical security update was issued for the npm library binary-parser to remediate CVE-2026-1245, a code injection flaw affecting versions earlier than 2.3.0. The vulnerability allows remote unauthenticated attackers to inject and execute arbitrary JavaScript when applications use user-controlled field names or encoding parameters in dynamically generated parser code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A code-injection vulnerability in the Node.js npm package **binary-parser** can allow attackers to execute arbitrary JavaScript when applications build parser definitions from **untrusted input**. Tracked as **CVE-2026-1245**, the issue affects **binary-parser versions < 2.3.0** and stems from the library’s use of dynamic code generation: it constructs JavaScript source at runtime and compiles it using the `Function` constructor for performance. CERT/CC and third-party reporting indicate the flaw occurs because **user-supplied values**—notably **parser field names** and **encoding parameters**—can be incorporated into the generated code **without sanitization**, enabling attacker-controlled modification of the resulting executable parser logic. Impact depends on how the library is used: applications with **static, hard-coded** parser definitions are not affected, but implementations that allow external input to influence parser structure (e.g., user-defined parsing of uploaded content) may enable code execution with the **privileges of the Node.js process**; upgrading to **2.3.0** is the primary remediation, with patches noted as released **November 26, 2025**.
Jun 29, 2026
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-61927, has been discovered in the Happy DOM JavaScript library, which is widely used for server-side rendering and testing frameworks. The flaw allows attackers to escape the virtual machine (VM) context, potentially leading to remote code execution on affected systems. Happy DOM, with over 2.7 million weekly downloads, is integrated into numerous applications, amplifying the potential impact of this vulnerability. The root cause of the issue lies in improper isolation of the Node.js VM context in Happy DOM versions 19 and earlier, which fails to adequately sandbox untrusted code. Security researcher Mas0nShi identified that attackers can exploit the JavaScript constructor inheritance chain to access the global Function constructor, enabling arbitrary code execution. In environments using the CommonJS module system, attackers can further leverage the require() function to import and execute additional modules, broadening the attack surface. While ECMAScript module (ESM) environments restrict some capabilities, they are still affected by the core VM context escape. The vulnerability has been assigned a CVSS score of 9.4, underscoring its severity and the urgency for remediation. Millions of applications that rely on Happy DOM for testing or server-side rendering are at risk if they have not updated to a patched version. The flaw enables attackers to bypass intended security boundaries, potentially compromising the host system and any sensitive data processed within the affected environment. Security advisories recommend immediate updates to the latest version of Happy DOM to mitigate the risk. Organizations are urged to review their software supply chain for dependencies on Happy DOM and to apply patches as soon as possible. The vulnerability highlights the risks associated with improper sandboxing in JavaScript environments, especially in widely adopted open-source libraries. No reports of active exploitation have been confirmed at this time, but the public disclosure and technical details increase the likelihood of exploitation attempts. Security teams should monitor for suspicious activity related to Node.js processes and review application logs for signs of compromise. The incident serves as a reminder of the importance of rigorous security testing and isolation in libraries that execute untrusted code. Developers and DevOps teams should prioritize dependency management and vulnerability scanning to reduce exposure to similar flaws in the future.
Jun 29, 2026