A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.
Popular AI interface was plagued by an 8/10 bug, but a fix is now available.