A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.
These functions prioritize performance at the expense of certain features. The serialized JSON output of these functions is identical to that of JSON.stringify() with the following exceptions: ...