[pkg-vuln] GHSA-5c6j-r48x-rmvq in serialize-javascript@6.0.2 #1368

New Issue

kert · 2026-10-27T16:14:56Z

kert commented

2026-10-27 16:14:56 +00:00

Severity: HIGH
Package: serialize-javascript @ 6.0.2
Fixed in: 7.0.3

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialize

Reference: https://nvd.nist.gov/vuln/detail/GHSA-5c6j-r48x-rmvq

**Severity:** HIGH **Package:** `serialize-javascript` @ `6.0.2` **Fixed in:** `7.0.3` ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`. If an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialize **Reference:** https://nvd.nist.gov/vuln/detail/GHSA-5c6j-r48x-rmvq

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-27 16:14:56 +00:00

kert added the quality ci labels 2026-10-27 16:14:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1368