Executive brief
serialize-javascript is a popular JavaScript library used to convert objects into serialized strings for data transmission and storage. Versions prior to 2.1.1 fail to properly escape special characters in serialized regular expressions, allowing attackers to inject malicious scripts. This issue primarily affects web applications that use this library to serialize data and render it in browsers outside of Node.js environments.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in the serialize-javascript npm package prior to version 2.1.1. The vulnerability exists because the library does not properly sanitize or escape unsafe characters when serializing JavaScript regular expression objects. When serialized regex patterns are deserialized and rendered in a browser context (the vulnerability does not affect Node.js), an attacker can craft a malicious regular expression that injects arbitrary JavaScript code. The attack requires the attacker to control the input data being serialized or to exploit a scenario where user-controlled data is reflected. Patches are available in version 2.1.1 and later.
Affected products
- Yahoo serialize-javascript prior to 2.1.1
Timeline
- 2019-12-05: disclosed
- 2019-12-05: patched: Version 2.1.1 released