GHSA-3fjq-93xj-3f3f

Cross-Site Scripting in serialize-to-js

Source: GitHub Advisory Database (reviewed) Low CVE-2019-16772

Packages

Ecosystem	Package	Affected	Fixed in
npm	serialize-to-js	< 3.0.1	3.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. ## Recommendation Upgrade to version 3.0.1 or later.

References

External links from the advisory. They lead to third-party sites.

https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f web
https://nvd.nist.gov/vuln/detail/CVE-2019-16772 advisory
https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3 web
https://github.com/advisories/GHSA-3fjq-93xj-3f3f advisory
https://www.npmjs.com/advisories/1429 web