CVE-2019-16769

About vulnerability

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js’s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Affected product:

Acorn , Next.js , Node.js , boxen , check-updates , cross-spawn , execa , jpm , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , os-locale , semantic-release , semver , serialize-javascript , strong-globalize , strong-remoting , term-size , terser-webpack-plugin , uglifyjs-webpack-plugin , update-notifier , webpack , yargs

Affected packages:

next @ 5.1.0 (+39 more)

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js’s implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.