Is CVE-2019-16772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-16772 being exploited in the wild.

How severe is CVE-2019-16772?

Low severity, with a CVSS score of 3.1, published 6 December 2019.

Which products and versions are affected?

serialize-to-js (npm) SEMVER:introduced=0,fixed=3.0.1.

Is there a fix for CVE-2019-16772?

Yes. serialize-to-js (npm): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-16772 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-16772?

Check whether you run serialize-to-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-16772: commenthol serialize-to-js XSS in serialized regular expressions

CVE-2019-16772 · Severity: low · CVSS 3.1 · Published 2019-12-06

The serialize-to-js library, used to convert JavaScript objects into strings for storage or transmission, is vulnerable to cross-site scripting (XSS). An attacker could provide a specially crafted regular expression that, when processed and displayed in a web browser, executes malicious code. This could lead to unauthorized actions being performed in a user's session or the theft of sensitive information.

Technologies: serialize-to-js (npm). Vendors: npm.

Quick answers

Is CVE-2019-16772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-16772 being exploited in the wild.
How severe is CVE-2019-16772?: Low severity, with a CVSS score of 3.1, published 6 December 2019.
Which products and versions are affected?: serialize-to-js (npm) SEMVER:introduced=0,fixed=3.0.1.
Is there a fix for CVE-2019-16772?: Yes. serialize-to-js (npm): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-16772 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-16772?: Check whether you run serialize-to-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

serialize-to-js (npm): upgrade to 3.0.1 or later
```
npm install serialize-to-js@3.0.1
```

Technical details

The serialize-to-js package prior to version 3.0.1 is vulnerable to Cross-Site Scripting (XSS) because it fails to properly sanitize or escape unsafe characters within serialized regular expression objects. The root cause is the use of `RegExp.prototype.toString()` which, in non-Node.js environments, may not adequately escape forward slashes or other characters that can break out of a script context. An attacker can exploit this by providing a malicious regular expression that is subsequently serialized and rendered in a browser environment. While Node.js environments are inherently protected by their specific implementation of `RegExp.toString()`, applications that serialize data for use in client-side JavaScript are at risk. The vulnerability is fixed in version 3.0.1 by explicitly constructing a `new RegExp()` string using the source and flags of the object.

Affected products

commenthol serialize-to-js < 3.0.1

Identifiers

CVE-2019-16772
GHSA-3fjq-93xj-3f3f

Timeline

2019-12-06: disclosed
2019-12-06: patched: Fixed in version 3.0.1
2019-12-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.