Executive brief
A vulnerability exists in a popular JavaScript library used to convert data into a format that can be sent over the web. An attacker could use this flaw to inject malicious scripts into a website, potentially leading to the theft of user session information or unauthorized actions on behalf of visitors. This risk is highest for applications that send complex data types directly to a user's web browser.
Technical details
A Cross-site Scripting (XSS) vulnerability (CWE-79) exists in the npm package 'serialize-javascript' versions 6.0.0 through 6.0.1. The root cause is improper neutralization of input during the serialization of specific JavaScript object types, such as regular expressions (regex). An attacker with the ability to provide input that is subsequently serialized and sent to a client-side environment can inject malicious code. This code executes when the data is deserialized by a web browser. The vulnerability is patched in version 6.0.2.
Affected products
- Yahoo serialize-javascript >= 6.0.0, < 6.0.2
Timeline
- 2025-02-10: disclosed
- 2025-02-10: advisory
- 2025-02-10: patched: Version 6.0.2 released