Insecure serialization leading to RCE in serialize-javascript
RSS Feed
HIGH
GHSA-hxcc-f52p-wc94
CVE-2020-7660
Description:
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
Affected Packages
| Ecosystem | Package | Vulnerable Versions | Patched Version |
|---|---|---|---|
| npm |
serialize-javascript
|
< 3.1.0 |
3.1.0
|
Bump serialize-javascript and mocha
Open about 5 hours ago
styled-components/vscode-styled-components #454
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 1 day ago
less/less-plugin-clean-css #54
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 2 days ago
anseki/gnirts #18
npm:mocha
npm:serialize-javascript
chore(deps): bump serialize-javascript and mocha
Closed 2 days ago
inikulin/dmn #69
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 2 days ago
null-none/html-component #24
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and @iobroker/testing
Open 2 days ago
DrozmotiX/ioBroker.discovergy #388
npm:serialize-javascript
npm:@iobroker/testing
Bump serialize-javascript and mocha
Closed 4 days ago
iobroker-community-adapters/ioBroker.owntracks #405
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Open 4 days ago
eugef/node-mocks-http #341
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Open 4 days ago
iobroker-community-adapters/ioBroker.panasonic-viera #455
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 4 days ago
markabrahams/node-net-snmp #311
npm:mocha
npm:serialize-javascript
Bump the npm_and_yarn group across 1 directory with 8 updates
Closed 5 days ago
packalares/packalares #2
npm:webpack-dev-server
npm:serialize-javascript
+6 more
Bump serialize-javascript and @iobroker/testing
Closed 5 days ago
iobroker-community-adapters/ioBroker.telegram #1381
npm:serialize-javascript
npm:@iobroker/testing
Bump serialize-javascript and mocha
Closed 6 days ago
openlayers/mapbox-to-css-font #38
npm:mocha
npm:serialize-javascript
chore(deps): bump serialize-javascript and mocha
Closed 6 days ago
willmorgan/stub-azure-function-context #430
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 6 days ago
SunilWang/node-os-utils #52
npm:mocha
npm:serialize-javascript
deps: bump the npm_and_yarn group across 1 directory with 2 updates
Closed 6 days ago
stagefrightband/stagefrightband.github.io #108
npm:serialize-javascript
npm:svgo
Bump serialize-javascript and @iobroker/testing
Closed 6 days ago
iobroker-community-adapters/ioBroker.rainbird #257
npm:serialize-javascript
npm:@iobroker/testing
Bump serialize-javascript and @iobroker/testing
Open 8 days ago
iobroker-community-adapters/ioBroker.spotify-premium #614
npm:serialize-javascript
npm:@iobroker/testing
Bump the npm_and_yarn group across 1 directory with 11 updates
Open 9 days ago
narendra486/SecurityTest #20
npm:webpack-dev-server
npm:axios
+9 more
Bump the npm_and_yarn group across 1 directory with 7 updates
Closed 9 days ago
sthj7319-bit/CopilotForXcode #18
npm:webpack
npm:serialize-javascript
+5 more
Bump serialize-javascript and mocha
Closed 9 days ago
chris48s/eslint-plugin-icedfrisby #252
npm:mocha
npm:serialize-javascript
chore(deps): bump serialize-javascript and @iobroker/testing
Open 9 days ago
iobroker-community-adapters/ioBroker.device-watcher #704
npm:serialize-javascript
npm:@iobroker/testing
Bump serialize-javascript from 6.0.2 to 7.1.1 in the npm_and_yarn group across 1 directory
Open 9 days ago
Hawthorne001/hyperwatch #22
npm:serialize-javascript
Bump serialize-javascript and @iobroker/testing
Open 9 days ago
afuerhoff/ioBroker.solarviewdatareader #310
npm:serialize-javascript
npm:@iobroker/testing
Bump the npm_and_yarn group across 1 directory with 4 updates
Closed 9 days ago
Stars-and-Stripes-Honor-Flight/sshf-api #91
npm:serialize-javascript
npm:body-parser
+2 more
chore(deps): bump serialize-javascript and @angular-devkit/build-angular in /frontend
Open 10 days ago
kir-ushakov/public-ba-codebase #99
npm:serialize-javascript
npm:@angular-devkit/build-angular
Bump the npm_and_yarn group across 1 directory with 7 updates
Closed 10 days ago
Pekiskok25/CopilotForXcode #17
npm:webpack
npm:serialize-javascript
+5 more
Bump the npm_and_yarn group across 1 directory with 6 updates
Closed 10 days ago
jabari-max/CopilotForXcode #17
npm:webpack
npm:serialize-javascript
+4 more
Bump serialize-javascript from 6.0.2 to 7.1.1 in the npm_and_yarn group across 1 directory
Closed 10 days ago
jan-tdy/VacuumCard-ADV #14
npm:serialize-javascript
chore(deps): bump serialize-javascript and mocha in /packages/sdks/@flagmind/edge
Open 10 days ago
sairam0424/Tombstone #213
npm:mocha
npm:serialize-javascript
Bump the npm_and_yarn group across 1 directory with 6 updates
Closed 12 days ago
whartondylan/CopilotForXcode #15
npm:webpack
npm:serialize-javascript
+4 more
chore(deps): bump serialize-javascript and mocha
Open 12 days ago
playcanvas/editor #2235
npm:mocha
npm:serialize-javascript
build(deps): bump serialize-javascript and mocha
Closed 12 days ago
Forsakringskassan/cypress-config #10
npm:mocha
npm:serialize-javascript
build(deps): Bump serialize-javascript and mocha in /src/LoggerUsage.VSCode
Open 12 days ago
Meir017/dotnet-logging-tools #296
npm:mocha
npm:Bump serialize-javascript
chore(deps): bump serialize-javascript, @rollup/plugin-terser and mocha
Closed 12 days ago
kurkle/chartjs-plugin-gradient #277
npm:mocha
npm:serialize-javascript, @rollup/plugin-terser
Bump serialize-javascript and mocha in /packages/vscode-extension
Closed 12 days ago
oracle/netsuite-suitecloud-sdk #1152
npm:mocha
npm:serialize-javascript
Bump serialize-javascript and mocha
Closed 12 days ago
yo35/kokopu #71
npm:mocha
npm:serialize-javascript
chore(deps): bump serialize-javascript and mocha
Open 12 days ago
takase1121/notcached #29
npm:mocha
npm:serialize-javascript
deps: bump serialize-javascript and mocha
Open 12 days ago
neovim/node-client #552
npm:mocha
npm:serialize-javascript
Bump the npm_and_yarn group across 1 directory with 2 updates
Closed 13 days ago
ykominami/fizz-buzz #122
npm:serialize-javascript
npm:@humanfs/node
chore: Bump serialize-javascript and mocha
Open 14 days ago
FlowFuse/device-agent #734
npm:mocha
npm:Bump serialize-javascript
chore(deps): bump serialize-javascript and @rollup/plugin-terser
Closed about 2 months ago
kinde-oss/kinde-auth-pkce-js #140
npm:serialize-javascript
npm:@rollup/plugin-terser
chore(deps): bump the version-updates-group group with 18 updates
Closed 3 months ago
yosuke-291/dependabot-grouped-security-poc #7
npm:axios
npm:ws
+16 more
Bump the npm_and_yarn group across 1 directory with 10 updates
Closed 3 months ago
first5455/vibe-tournament-organization #55
npm:react-router
npm:vite
+4 more
build(deps): bump the npm_and_yarn group across 33 directories with 12 updates
Open 3 months ago
hashim21223445/angular #331
npm:webpack-dev-server
npm:@angular/common
+7 more
build(deps): bump the npm_and_yarn group across 28 directories with 12 updates
Closed 3 months ago
hashim21223445/angular #327
npm:webpack-dev-server
npm:@angular/common
+7 more
Bump serialize-javascript and workbox-build
Open 3 months ago
unixfy/alexwang.net #209
npm:serialize-javascript
npm:workbox-build
Bump serialize-javascript and css-minimizer-webpack-plugin
Closed 3 months ago
cpprefjp/kunai #168
npm:serialize-javascript
npm:css-minimizer-webpack-plugin
Bump serialize-javascript and workbox-build
Open 3 months ago
lordfpx/chinese-words #8
npm:serialize-javascript
npm:workbox-build
chore(deps): bump the npm_and_yarn group across 18 directories with 13 updates
Closed 3 months ago
goodgollyholly/react-router #3
npm:undici
npm:serialize-javascript
+5 more
Actions
Advisory Details
| Published: | August 11, 2020 about 6 years ago |
| Updated: | September 02, 2026 13 days ago |
| CVSS Score: | 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS: | 2.60% 84th percentile |
| Source: | Github |
| Classification: | GENERAL |
| UUID: | MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4Y2MtZjUycC13Yzk0 |
PR Statistics
PR Status
Open
163 (38.9%)
Merged
0 (0.0%)
Closed
256 (61.1%)
Update Types
Major
612 (39.7%)
Minor
425 (27.6%)
Patch
454 (29.5%)