A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.

Remote code execution vulnerability CVE-2026-20045 is considered critical by the vendor, as the US cyber agency adds the vulnerability to its KEV catalogue.