Code Injection Vulnerability in binary-parser Library
Summary
GHSA-m39p-34qh-rh3w: binary-parser library has a code injection vulnerability. Affects binary-parser versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The binary-parser library is a popular tool in the Node.js ecosystem that allows developers to define binary data structures and parse binary data efficiently. It is widely used for applications that require reading and writing binary files, such as network protocols and file formats. However, prior to version 2.3.0, the library had a significant vulnerability that allowed for code injection through untrusted input.
Vulnerability Detail
A code injection vulnerability exists in the binary-parser library versions prior to 2.3.0. This vulnerability arises from the library's practice of directly interpolating untrusted values into dynamically generated JavaScript code without proper sanitization. As a result, an attacker can exploit this flaw by providing malicious input in parser field names or encoding parameters, leading to arbitrary code execution within the Node.js process. This could potentially allow attackers to manipulate the application, access sensitive data, or execute harmful operations.
How To Fix
Minimum fixed version
2.3.0
This is the first release that contains the fix.
npm install binary-parser@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to validate and sanitize all input values used in parser field names and encoding parameters to prevent untrusted data from being executed. However, this is not a substitute for upgrading to the patched version.
Conclusion
The binary-parser library has a critical code injection vulnerability that can lead to severe security risks if untrusted input is processed. It is crucial to update to version 2.3.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in your software.
See every vulnerability recorded for binary-parser →
FAQ
The binary-parser library is used for defining and parsing binary data structures in Node.js applications, making it easier to work with binary files and protocols.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. You can visit the Vulert playground at Vulert Scanner to analyze your package-lock.json file.
The consequences of this vulnerability include the possibility of arbitrary code execution, which can lead to unauthorized access, data manipulation, and other malicious activities within your application.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
If you cannot update the library right away, ensure to validate and sanitize all inputs used in parser field names and encoding parameters as a temporary measure.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
