| Package | Affected versions | Patched versions |
|---|---|---|
| serialize-to-js | = 0.5.0 | |
| serialize-to-js | < 1.0.0 | 1.0.0 |
Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).
var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);
Update to version 1.0.0, or later, and review this disclaimer from the author.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free