# CVE-2019-16772: commenthol serialize-to-js XSS in serialized regular expressions

Source: https://junglewise.ai/threats/cve-2019-16772-commenthol-serialize-to-js-xss-in-serialized-regular-expressions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-06. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2019-16772 · Severity: low · CVSS 3.1 · Published 2019-12-06

The serialize-to-js library, used to convert JavaScript objects into strings for storage or transmission, is vulnerable to cross-site scripting (XSS). An attacker could provide a specially crafted regular expression that, when processed and displayed in a web browser, executes malicious code. This could lead to unauthorized actions being performed in a user's session or the theft of sensitive information.

Technologies: [serialize-to-js (npm)](https://junglewise.ai/threats/technologies/serialize-to-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-16772 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16772 being exploited in the wild.

**How severe is CVE-2019-16772?** Low severity, with a CVSS score of 3.1, published 6 December 2019.

**Which products and versions are affected?** serialize-to-js (npm) SEMVER:introduced=0,fixed=3.0.1.

**Is there a fix for CVE-2019-16772?** Yes. serialize-to-js (npm): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-16772 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-16772?** Check whether you run serialize-to-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- serialize-to-js (npm): upgrade to 3.0.1 or later

  ```sh
  npm install serialize-to-js@3.0.1
  ```


## Technical details

The serialize-to-js package prior to version 3.0.1 is vulnerable to Cross-Site Scripting (XSS) because it fails to properly sanitize or escape unsafe characters within serialized regular expression objects. The root cause is the use of `RegExp.prototype.toString()` which, in non-Node.js environments, may not adequately escape forward slashes or other characters that can break out of a script context. An attacker can exploit this by providing a malicious regular expression that is subsequently serialized and rendered in a browser environment. While Node.js environments are inherently protected by their specific implementation of `RegExp.toString()`, applications that serialize data for use in client-side JavaScript are at risk. The vulnerability is fixed in version 3.0.1 by explicitly constructing a `new RegExp()` string using the source and flags of the object.

## Affected products

- commenthol serialize-to-js < 3.0.1

## Identifiers

- CVE-2019-16772
- GHSA-3fjq-93xj-3f3f

## Timeline

- 2019-12-06: disclosed
- 2019-12-06: patched: Fixed in version 3.0.1
- 2019-12-06: advisory

## References

- [https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f](https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f)
- [https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3](https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3)
- [https://www.npmjs.com/advisories/1429](https://www.npmjs.com/advisories/1429)

## Related threats

- [serialize-to-js denial of service](https://junglewise.ai/threats/serialize-to-js-denial-of-service-133dbaec)
- [serialize-to-js arbitrary code execution through IIFE](https://junglewise.ai/threats/cve-2017-5954-serialize-to-js-arbitrary-code-execution-through-iife)