MEDIUM4.2

GHSA-h9rv-jmmf-4pgx

Cross-Site Scripting in serialize-javascript

Quick fix

GHSA-h9rv-jmmf-4pgx — serialize-javascript: upgrade to the fixed version with the command below.

npm install serialize-javascript@2.1.1

Details

Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

## Recommendation

Upgrade to version 2.1.1 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/serialize-javascript

Introduced in: 0Fixed in: 2.1.1

Fixnpm install serialize-javascript@2.1.1

References

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2019-16769[ADVISORY]
https://github.com/advisories/GHSA-h9rv-jmmf-4pgx[ADVISORY]
https://www.npmjs.com/advisories/1426[WEB]