Description
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
yahoo serialize-javascript
Default version status: unaffected
7.0.1 to < 7.1.3affected
pkg:npm/serialize-javascriptReferences
- https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v ↗
- https://github.com/yahoo/serialize-javascript/pull/235 ↗
- https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 ↗
- https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.3 ↗
- https://www.vulncheck.com/advisories/serialize-javascript-7.0.1-before-7.1.3-xss-via-unescaped-script-in-function-body ↗