Executive brief
The serialize-to-js library, used to convert JavaScript objects into strings for storage or transmission, is vulnerable to cross-site scripting (XSS). An attacker could provide a specially crafted regular expression that, when processed and displayed in a web browser, executes malicious code. This could lead to unauthorized actions being performed in a user's session or the theft of sensitive information.
Technical details
The serialize-to-js package prior to version 3.0.1 is vulnerable to Cross-Site Scripting (XSS) because it fails to properly sanitize or escape unsafe characters within serialized regular expression objects. The root cause is the use of `RegExp.prototype.toString()` which, in non-Node.js environments, may not adequately escape forward slashes or other characters that can break out of a script context. An attacker can exploit this by providing a malicious regular expression that is subsequently serialized and rendered in a browser environment. While Node.js environments are inherently protected by their specific implementation of `RegExp.toString()`, applications that serialize data for use in client-side JavaScript are at risk. The vulnerability is fixed in version 3.0.1 by explicitly constructing a `new RegExp()` string using the source and flags of the object.
Affected products
- commenthol serialize-to-js < 3.0.1
Timeline
- 2019-12-06: disclosed
- 2019-12-06: patched: Fixed in version 3.0.1
- 2019-12-06: advisory