GHSA-w5q7-3pr9-x44w

Source

https://github.com/advisories/GHSA-w5q7-3pr9-x44w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w5q7-3pr9-x44w/GHSA-w5q7-3pr9-x44w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w5q7-3pr9-x44w

Published

2020-09-02T15:59:19Z

Modified

2020-08-31T18:35:52Z

Summary

Denial of Service in serialize-to-js

Details

Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.

Recommendation

Upgrade to version 2.0.0 or later.

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:35:52Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/790

Affected packages

npm / serialize-to-js

Package

Name: serialize-to-js; View open source insights on deps.dev
Purl: pkg:npm/serialize-to-js

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w5q7-3pr9-x44w/GHSA-w5q7-3pr9-x44w.json"