6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1245

CVE-2026-1245: CVE-2026-1245

A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1245

CVE-2026-1245:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
binary-parser	npm	< 2.3.0	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a code injection flaw in the binary-parser library, occurring when the library dynamically generates parser code. The analysis of the patch commit fd24894054136e17b405fc490c4434adec5cc3b6 reveals that user-provided strings for field names and encoding types were being interpolated directly into this generated code without proper sanitization.

Two primary vulnerable points were identified and fixed:

Field Name Injection: Parser-defining methods (e.g., uint8, string) accept a varName parameter that is passed to the internal setNextParser method. Previously, this method directly assigned the varName, which was then used in code generation. The patch introduces sanitizeFieldName to validate the name, fixing the vulnerability within setNextParser.
Encoding Parameter Injection: The string method used the encoding option without validation. The patch adds a call to sanitizeEncoding at the beginning of the string method to check the encoding against an allowlist.

An attacker could exploit this by crafting a parser with a malicious field name or by using the .string() method with a malicious encoding value, leading to arbitrary code execution. The identified functions, Parser.setNextParser and Parser.string, are the precise locations where the untrusted data was processed and where the security controls were implemented.

Vulnerable functions

Parser.setNextParser

lib/binary_parser.ts

The `setNextParser` function, which is called internally by methods like `uint8`, `int16`, etc., was assigning the user-provided `varName` directly to a parser object property. This property was later used to dynamically generate JavaScript code for the parser. By providing a crafted string as a field name (e.g., 'a; console.log("INJECTED"); //'), an attacker could inject and execute arbitrary code. The patch mitigates this by sanitizing the `varName` before assignment.

Parser.string

lib/binary_parser.ts

The `string` method accepts an `encoding` parameter within its options object. This encoding value was used directly in the dynamically generated parser code without validation. An attacker could provide a malicious string designed to break out of the code's string context and inject arbitrary JavaScript (e.g., 'utf8'); console.log('INJECTED'); //'). The patch adds a call to a new `sanitizeEncoding` function, which validates the encoding against a safe allowlist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.