GitHub Advisoryadvisory · npm

GHSA-h9rv-jmmf-4pgx Cross-Site Scripting in serialize-javascript

MEDIUM Published 2019-12-05 Modified 2021-01-08 Official page ↗
Aliases
CVE-2019-16769
Ecosystem
npm
Packages
serialize-javascript
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm serialize-javascript: < 2.1.1 → fixed in 2.1.1

Description

Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 2.1.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-16769 The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References