GHSA-hxcc-f52p-wc94
Insecure serialization leading to RCE in serialize-javascript
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | serialize-javascript | < 3.1.0 | 3.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
An object such as `{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}` was serialized as `{"foo": /1"/, "bar": "a\/1"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
References
External links from the advisory. They lead to third-party sites.