Is CVE-2019-16769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-16769 being exploited in the wild.

How severe is CVE-2019-16769?

Low severity, with a CVSS score of 3.1, published 5 December 2019.

Which products and versions are affected?

serialize-javascript (npm) SEMVER:introduced=0,fixed=2.1.1.

Is there a fix for CVE-2019-16769?

Yes. serialize-javascript (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-16769 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-16769?

Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-16769: serialize-javascript Cross-Site Scripting in regular expressions

CVE-2019-16769 · Severity: low · CVSS 3.1 · Published 2019-12-05

serialize-javascript is a popular JavaScript library used to convert objects into serialized strings for data transmission and storage. Versions prior to 2.1.1 fail to properly escape special characters in serialized regular expressions, allowing attackers to inject malicious scripts. This issue primarily affects web applications that use this library to serialize data and render it in browsers outside of Node.js environments.

Technologies: serialize-javascript (npm). Vendors: npm.

Quick answers

Is CVE-2019-16769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-16769 being exploited in the wild.
How severe is CVE-2019-16769?: Low severity, with a CVSS score of 3.1, published 5 December 2019.
Which products and versions are affected?: serialize-javascript (npm) SEMVER:introduced=0,fixed=2.1.1.
Is there a fix for CVE-2019-16769?: Yes. serialize-javascript (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-16769 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-16769?: Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

serialize-javascript (npm): upgrade to 2.1.1 or later
```
npm install serialize-javascript@2.1.1
```

Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in the serialize-javascript npm package prior to version 2.1.1. The vulnerability exists because the library does not properly sanitize or escape unsafe characters when serializing JavaScript regular expression objects. When serialized regex patterns are deserialized and rendered in a browser context (the vulnerability does not affect Node.js), an attacker can craft a malicious regular expression that injects arbitrary JavaScript code. The attack requires the attacker to control the input data being serialized or to exploit a scenario where user-controlled data is reflected. Patches are available in version 2.1.1 and later.

Affected products

Yahoo serialize-javascript prior to 2.1.1

Identifiers

CVE-2019-16769
GHSA-h9rv-jmmf-4pgx

Timeline

2019-12-05: disclosed
2019-12-05: patched: Version 2.1.1 released

References

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.