Cross-Site Scripting in serialize-javascript

中 5.4CVE-2019-16769 · GHSA-h9rv-jmmf-4pgx · 05/12/2019 公開 · 17/06/2026 更新

要点

CVE-2019-16769 は serialize-javascript (verizon), serialize-javascript に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.80%（全脆弱性の 56.6% より高い）。
対処：2.1.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
serialize-javascript verizon	`< 2.1.1`	`2.1.1`
serialize-javascript npm	`< 2.1.1`	`2.1.1`

概要

Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

Recommendation

Upgrade to version 2.1.1 or later.

NVD の説明

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.