PT-2019-14828 · Unknown · Serialize-To-Js

Published 2019-12-06 · Updated 2019-12-09 · CVE-2019-16772

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions serialize-to-js versions prior to 3.0.1

Description The issue arises from the improper handling of unsafe characters in serialized regular expressions, leading to Cross-site Scripting (XSS). This problem does not affect Node.js applications due to Node.js's implementation of RegExp.prototype.toString(), which backslash-escapes all forward slashes in regular expressions. The vulnerability is relevant when serialized data of regular expression objects are used in environments other than Node.js.

Recommendations Upgrade to version 3.0.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16772

GHSA-3FJQ-93XJ-3F3F

Affected Products

Serialize-To-Js

References · 7

• https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3 · Patch
• https://osv.dev/vulnerability/GHSA-3fjq-93xj-3f3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16772 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16772 · Vendor Advisory
• https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f · Note
• https://npmjs.com/advisories/1429 · Note
• https://github.com/advisories/GHSA-3fjq-93xj-3f3f · Note