A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters.
CVSS 3.1MEDIUM 6.5·Network·No auth·No interaction·EPSS 0.00563·Published 2026-01-20·Fixed in 2.3.0CWE-94