Executive brief
The serialize-javascript npm package converts JavaScript objects into serialized strings for storage or transmission. An attacker who controls the input to this library can inject malicious code through RegExp flags or Date methods that gets executed when the serialized output is evaluated (via eval or new Function). This is an incomplete fix for a previous vulnerability and allows remote code execution in server environments that deserialize untrusted data.
Technical details
The vulnerability is a static code injection (CWE-96) affecting the serialize-javascript library's handling of RegExp and Date objects. When serializing a RegExp, the library properly escapes the source property but fails to escape the flags property, allowing an attacker to craft a fake RegExp object (via Object.create and property descriptors) that injects arbitrary code into the generated output string. Similarly, Date.prototype.toISOString() is called without sanitization, enabling injection through fake Date objects. The attack requires the attacker to control the input object passed to serialize(), and the injected code executes when the output is evaluated via eval(), new Function(), or script tags. This is particularly dangerous in Node.js environments where eval'd code has access to require() and can execute arbitrary system commands. The fix is available in version 7.0.3 and properly escapes both the flags property and Date serialization.
Affected products
- Yahoo serialize-javascript ≤ 7.0.2
Timeline
- 2026-02-28: disclosed
- 2026-02-27: patched: Fix released in version 7.0.3