HIGH8.1
GHSA-hxcc-f52p-wc94
Insecure serialization leading to RCE in serialize-javascript
Quick fix
GHSA-hxcc-f52p-wc94 — serialize-javascript: upgrade to the fixed version with the command below.
npm install serialize-javascript@3.1.0Details
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
An object such as `{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}` was serialized as `{"foo": /1"/, "bar": "a\/1"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
Are you affected?
Enter the version of the package you're using.