| Package | Affected versions | Patched versions |
|---|---|---|
| serialize-to-js | ≤ 1.1.1 |
The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free