Cross-Site Scripting in serialize-to-js

中 6.1CVE-2019-16772 · GHSA-3fjq-93xj-3f3f · 07/12/2019 公開 · 17/06/2026 更新

要点

CVE-2019-16772 は serialize-to-js (serialize-to-js project), serialize-to-js に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.65%（全脆弱性の 51.2% より高い）。
対処：3.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
serialize-to-js serialize-to-js_project	`< 3.0.1`	`3.0.1`
serialize-to-js npm	`< 3.0.1`	`3.0.1`

概要

Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

Recommendation

Upgrade to version 3.0.1 or later.

NVD の説明

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.