GHSA-5C6J-R48X-RMVQ Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Impact The serialize-javascript npm package versions tags, the injected code executes. javascript const serialize = require'serialize-javascript'; // Create an object that passes instanceof RegExp with a spoofed .flags const fakeRegex = Object.createRegExp.prototype; Object.definePropertyfakeRege...

PT-2026-8194

In the Linux kernel, the following vulnerability has been resolved: hwmon: acpi power meter Fix deadlocks related to acpi power meter notify The acpi power meter driver's .notify callback function, acpi power meter notify, calls hwmon device unregister under a lock that is also acquired by...

PT-2026-7809

Name of the Vulnerable Software and Affected Versions next-mdx-remote versions 4.3.0 through 5.0.0 Description The serialize function within next-mdx-remote is susceptible to arbitrary code execution because of inadequate sanitization of MDX content. This allows untrusted MDX to execute JavaScrip...

npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by...

CVE-2025-71074

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffsepfileopen can race with removal, ending up with file-privatedata pointing to freed object. There is a total count of opened files on functionfs both ep0 and dynamic ones and when it hits...

CVE-2019-16772

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in npm-serialize-javascript (CVE-2024-11831)

Summary npm-serialize-javascript is used by IBM Storage Ceph in assorted components. CVE-2024-11831 Vulnerability Details CVEID:CVE-2024-11831 DESCRIPTION: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize...

Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Cross-site Scripting due to serialize-javascript

Summary serialize-javascript is used by IBM watsonx Orchestrate Developer Edition as part of wxo-chat image Vulnerability Details CVEID:CVE-2024-11831 DESCRIPTION: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly...

EUVD-2025-176422

Malicious code in serialize-minify-decompress-mu-cron npm...

EUVD-2025-177883

Malicious code in meta-grep-stack-serialize-authenticate npm...

EUVD-2025-176420

Malicious code in serialize-short-grep-async-float npm...

EUVD-2025-180123

Malicious code in bash-serialize-decode-grid-sudo npm...

EUVD-2025-176578

Malicious code in runtime-promise-assert-async-serialize npm...

Malicious code in good-serialize-protected-tau-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d96e8ca90f6efdce57d44d772017ed7d940eb888854d1044f6330ce7ec439930 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176424

Malicious code in serialize-eta-authenticate-authorize-sigma npm...

EUVD-2025-176419

Malicious code in serialize-stack-omega-node-authorize npm...

Malicious code in data-omicron-static-quick-serialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97c8d1da347318b5318ddda1ff9c1c3266f2d3270183260959e34ef8f878b576 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176421

Malicious code in serialize-quick-alpha-book-resolve npm...

EUVD-2025-176140

Malicious code in sun-serialize-parse-validate-alert npm...

MAL-2025-186895 Malicious code in execute-char-char-stub-serialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe5d9354bb43f2724bc7efeec94e26f50bce0f7ac425402af053df136cd5c11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...