CVE-2019-16769

Source
https://nvd.nist.gov/vuln/detail/CVE-2019-16769
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16769.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-16769
Aliases
Related
Published
2019-12-05T19:15:15Z
Modified
2024-05-14T06:55:50.271919Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

References

Affected packages

Git / github.com/yahoo/serialize-javascript

Affected ranges

Type
GIT
Repo
https://github.com/yahoo/serialize-javascript
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v1.*

v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v1.9.1

v2.*

v2.0.0
v2.1.0