GitHub Advisoryadvisory · npm

GHSA-3fjq-93xj-3f3f Cross-Site Scripting in serialize-to-js

LOW Published 2019-12-06 Modified 2023-11-06 Official page ↗
Aliases
CVE-2019-16772
Ecosystem
npm
Packages
serialize-to-js
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm serialize-to-js: < 3.0.1 → fixed in 3.0.1

Description

Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 3.0.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-16772 The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References