Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-kmtn-rrhj-rkh6
Vulnerability ID VCID-kmtn-rrhj-rkh6
Aliases CVE-2026-1245
GHSA-m39p-34qh-rh3w
Summary A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2026-1245
epss 0.00087 https://api.first.org/data/v1/epss?cve=CVE-2026-1245
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-m39p-34qh-rh3w
cvssv3.1 6.5 https://github.com/keichi/binary-parser
generic_textual MODERATE https://github.com/keichi/binary-parser
ssvc Track https://github.com/keichi/binary-parser
cvssv3.1 6.5 https://github.com/keichi/binary-parser/pull/283
generic_textual MODERATE https://github.com/keichi/binary-parser/pull/283
ssvc Track https://github.com/keichi/binary-parser/pull/283
cvssv3.1 6.5 https://kb.cert.org/vuls/id/102648
generic_textual MODERATE https://kb.cert.org/vuls/id/102648
ssvc Track https://kb.cert.org/vuls/id/102648
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-1245
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-1245
cvssv3.1 6.5 https://www.cve.org/CVERecord?id=CVE-2026-1245
generic_textual MODERATE https://www.cve.org/CVERecord?id=CVE-2026-1245
cvssv3.1 6.5 https://www.kb.cert.org/vuls/id/102648
generic_textual MODERATE https://www.kb.cert.org/vuls/id/102648
cvssv3.1 6.5 https://www.npmjs.com/package/binary-parser
generic_textual MODERATE https://www.npmjs.com/package/binary-parser
ssvc Track https://www.npmjs.com/package/binary-parser
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-1245
https://www.cve.org/CVERecord?id=CVE-2026-1245
https://www.kb.cert.org/vuls/id/102648
102648 https://kb.cert.org/vuls/id/102648
283 https://github.com/keichi/binary-parser/pull/283
binary-parser https://github.com/keichi/binary-parser
binary-parser https://www.npmjs.com/package/binary-parser
CVE-2026-1245 https://nvd.nist.gov/vuln/detail/CVE-2026-1245
GHSA-m39p-34qh-rh3w https://github.com/advisories/GHSA-m39p-34qh-rh3w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keichi/binary-parser
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-21T16:44:44Z/ Found at https://github.com/keichi/binary-parser
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keichi/binary-parser/pull/283
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-21T16:44:44Z/ Found at https://github.com/keichi/binary-parser/pull/283
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://kb.cert.org/vuls/id/102648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-21T16:44:44Z/ Found at https://kb.cert.org/vuls/id/102648
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-1245
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.cve.org/CVERecord?id=CVE-2026-1245
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.kb.cert.org/vuls/id/102648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.npmjs.com/package/binary-parser
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-21T16:44:44Z/ Found at https://www.npmjs.com/package/binary-parser
Exploit Prediction Scoring System (EPSS)
Percentile 0.25048
EPSS Score 0.00087
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:49:58.886602+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/1xxx/CVE-2026-1245.json 38.6.0