要点
- CVE-2019-16769 是影响 serialize-javascript (verizon), serialize-javascript 的中危 (CVSS 5.4)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.80%，高于 56.6% 的漏洞。
- 修复：升级到 2.1.1 或更高版本。
Description
Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.
Recommendation
Upgrade to version 2.1.1 or later.
NVD description
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
serialize-javascript 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free