CVE-2019-16772

2019-12-0700:15:11

Google

osv.dev

0.001 Low

EPSS

Percentile

29.3%

JSON

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js’s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

CPENameOperatorVersion
serialize-to-jseq1.2.2
serialize-to-jseq1.1.1
serialize-to-jseq0.2.0
serialize-to-jseq0.1.2
serialize-to-jseq0.3.1
serialize-to-jseq1.2.1
serialize-to-jseq0.5.0
serialize-to-jseq1.1.0
serialize-to-jseq2.0.0
serialize-to-jseq3.0.0

Name	Operator	Version
serialize-to-js	eq	1.2.2
serialize-to-js	eq	1.1.1
serialize-to-js	eq	0.2.0
serialize-to-js	eq	0.1.2
serialize-to-js	eq	0.3.1
serialize-to-js	eq	1.2.1
serialize-to-js	eq	0.5.0
serialize-to-js	eq	1.1.0
serialize-to-js	eq	2.0.0
serialize-to-js	eq	3.0.0