PkgSeer

Vulnerability GHSA-76p7-773f-r4q5

Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
February 10, 2025 at 06:30 PM UTC
Cross-site Scripting (XSS) in serialize-javascript
6.0.0 - 6.0.1
6.0.0 - 6.0.1

Summary

Cross-site Scripting (XSS) in serialize-javascript

Details

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Low Risk
16 days ago
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
7.1.1 GHSA-gfhx-hw2g-v5hg
7.1.1 GHSA-gfhx-hw2g-v5hg
Medium Risk
6 months ago
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
5.0.0 - 7.0.4 GHSA-qj8w-gfj5-8c6v
5.0.0 - 7.0.4 GHSA-qj8w-gfj5-8c6v
High Risk
7 months ago
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
1.0.0 - 7.0.2 GHSA-5c6j-r48x-rmvq
1.0.0 - 7.0.2 GHSA-5c6j-r48x-rmvq
High Risk
6 years ago
Insecure serialization leading to RCE in serialize-javascript
1.0.0 - 3.0.0 GHSA-hxcc-f52p-wc94
1.0.0 - 3.0.0 GHSA-hxcc-f52p-wc94
Medium Risk
6 years ago
Cross-Site Scripting in serialize-javascript
1.0.0 - 2.1.0 GHSA-h9rv-jmmf-4pgx
1.0.0 - 2.1.0 GHSA-h9rv-jmmf-4pgx
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
1 year ago
February 10, 2025 at 06:30 PM UTC
Fixed (6.0.2)
2 years ago
January 09, 2024 at 01:06 AM UTC
Last Modified
1 day ago
October 15, 2026 at 09:45 PM UTC