The binary-parser library accepts parser field names and encoding parameters from untrusted data and directly interpolates them into dynamically generated code without sanitization. This flaw, identified as an instance of code injection (CWE‑94), allows an attacker to execute arbitrary JavaScript within the Node.js process that consumes the library, leading to full compromise of the application context.

The vulnerability affects the open‑source binary-parser package published by keichi. All releases prior to version 2.3.0 are susceptible; versions 2.3.0 and later include the fix. The library is typically used in Node.js‑based projects via npm.

With a CVSS score of 6.5 the flaw carries medium severity. The EPSS score is less than 1 %, and the vulnerability is not currently listed in CISA’s KEV catalog, indicating a low probability of widespread exploitation. Since the attacker must supply crafted input that is processed by binary-parser, the attack vector is essentially local or requires compromise of an application that leverages the library. If an attacker controls or injects untrusted data into the parser, they can execute arbitrary code in the same privilege context as the Node.js process.