An open index of dependabot pull requests across open source projects.

Insecure serialization leading to RCE in serialize-javascript

GHSA-hxcc-f52p-wc94 CVE-2020-7660
Description:

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.

Affected Packages
Ecosystem Package Vulnerable Versions Patched Version
npm serialize-javascript < 3.1.0
3.1.0
Related Dependabot Pull Requests
Bump serialize-javascript and mocha
Open about 5 hours ago
styled-components/vscode-styled-components #454
npm:mocha npm:serialize-javascript
styled-components
Bump serialize-javascript and mocha
Closed 1 day ago
less/less-plugin-clean-css #54
npm:mocha npm:serialize-javascript
less
Bump serialize-javascript and mocha
Closed 2 days ago
anseki/gnirts #18
npm:mocha npm:serialize-javascript
anseki
chore(deps): bump serialize-javascript and mocha
Closed 2 days ago
inikulin/dmn #69
npm:mocha npm:serialize-javascript
inikulin
Bump serialize-javascript and mocha
Closed 2 days ago
null-none/html-component #24
npm:mocha npm:serialize-javascript
null-none
Bump serialize-javascript and @iobroker/testing
Open 2 days ago
DrozmotiX/ioBroker.discovergy #388
npm:serialize-javascript npm:@iobroker/testing
DrozmotiX
Bump serialize-javascript and mocha
Closed 4 days ago
iobroker-community-adapters/ioBroker.owntracks #405
npm:mocha npm:serialize-javascript
iobroker-community-adapters
Bump serialize-javascript and mocha
Open 4 days ago
eugef/node-mocks-http #341
npm:mocha npm:serialize-javascript
eugef
Bump serialize-javascript and mocha
Open 4 days ago
iobroker-community-adapters/ioBroker.panasonic-viera #455
npm:mocha npm:serialize-javascript
iobroker-community-adapters
Bump serialize-javascript and mocha
Closed 4 days ago
markabrahams/node-net-snmp #311
npm:mocha npm:serialize-javascript
markabrahams
Bump the npm_and_yarn group across 1 directory with 8 updates
Closed 5 days ago
packalares/packalares #2
npm:webpack-dev-server npm:serialize-javascript +6 more
packalares
Bump serialize-javascript and @iobroker/testing
Closed 5 days ago
iobroker-community-adapters/ioBroker.telegram #1381
npm:serialize-javascript npm:@iobroker/testing
iobroker-community-adapters
Bump serialize-javascript and mocha
Closed 6 days ago
openlayers/mapbox-to-css-font #38
npm:mocha npm:serialize-javascript
openlayers
chore(deps): bump serialize-javascript and mocha
Closed 6 days ago
willmorgan/stub-azure-function-context #430
npm:mocha npm:serialize-javascript
willmorgan
Bump serialize-javascript and mocha
Closed 6 days ago
SunilWang/node-os-utils #52
npm:mocha npm:serialize-javascript
SunilWang
deps: bump the npm_and_yarn group across 1 directory with 2 updates
Closed 6 days ago
stagefrightband/stagefrightband.github.io #108
npm:serialize-javascript npm:svgo
stagefrightband
Bump serialize-javascript and @iobroker/testing
Closed 6 days ago
iobroker-community-adapters/ioBroker.rainbird #257
npm:serialize-javascript npm:@iobroker/testing
iobroker-community-adapters
Bump serialize-javascript and @iobroker/testing
Open 8 days ago
iobroker-community-adapters/ioBroker.spotify-premium #614
npm:serialize-javascript npm:@iobroker/testing
iobroker-community-adapters
Bump the npm_and_yarn group across 1 directory with 11 updates
Open 9 days ago
narendra486/SecurityTest #20
npm:webpack-dev-server npm:axios +9 more
narendra486
Bump the npm_and_yarn group across 1 directory with 7 updates
Closed 9 days ago
sthj7319-bit/CopilotForXcode #18
npm:webpack npm:serialize-javascript +5 more
sthj7319-bit
Bump serialize-javascript and mocha
Closed 9 days ago
chris48s/eslint-plugin-icedfrisby #252
npm:mocha npm:serialize-javascript
chris48s
chore(deps): bump serialize-javascript and @iobroker/testing
Open 9 days ago
iobroker-community-adapters/ioBroker.device-watcher #704
npm:serialize-javascript npm:@iobroker/testing
iobroker-community-adapters
Bump serialize-javascript from 6.0.2 to 7.1.1 in the npm_and_yarn group across 1 directory
Open 9 days ago
Hawthorne001/hyperwatch #22
npm:serialize-javascript
Hawthorne001
Bump serialize-javascript and @iobroker/testing
Open 9 days ago
afuerhoff/ioBroker.solarviewdatareader #310
npm:serialize-javascript npm:@iobroker/testing
afuerhoff
Bump the npm_and_yarn group across 1 directory with 4 updates
Closed 9 days ago
Stars-and-Stripes-Honor-Flight/sshf-api #91
npm:serialize-javascript npm:body-parser +2 more
Stars-and-Stripes-Honor-Flight
chore(deps): bump serialize-javascript and @angular-devkit/build-angular in /frontend
Open 10 days ago
kir-ushakov/public-ba-codebase #99
npm:serialize-javascript npm:@angular-devkit/build-angular
kir-ushakov
Bump the npm_and_yarn group across 1 directory with 7 updates
Closed 10 days ago
Pekiskok25/CopilotForXcode #17
npm:webpack npm:serialize-javascript +5 more
Pekiskok25
Bump the npm_and_yarn group across 1 directory with 6 updates
Closed 10 days ago
jabari-max/CopilotForXcode #17
npm:webpack npm:serialize-javascript +4 more
jabari-max
Bump serialize-javascript from 6.0.2 to 7.1.1 in the npm_and_yarn group across 1 directory
Closed 10 days ago
jan-tdy/VacuumCard-ADV #14
npm:serialize-javascript
jan-tdy
chore(deps): bump serialize-javascript and mocha in /packages/sdks/@flagmind/edge
Open 10 days ago
sairam0424/Tombstone #213
npm:mocha npm:serialize-javascript
sairam0424
Bump the npm_and_yarn group across 1 directory with 6 updates
Closed 12 days ago
whartondylan/CopilotForXcode #15
npm:webpack npm:serialize-javascript +4 more
whartondylan
chore(deps): bump serialize-javascript and mocha
Open 12 days ago
playcanvas/editor #2235
npm:mocha npm:serialize-javascript
playcanvas
build(deps): bump serialize-javascript and mocha
Closed 12 days ago
Forsakringskassan/cypress-config #10
npm:mocha npm:serialize-javascript
Forsakringskassan
build(deps): Bump serialize-javascript and mocha in /src/LoggerUsage.VSCode
Open 12 days ago
Meir017/dotnet-logging-tools #296
npm:mocha npm:Bump serialize-javascript
Meir017
chore(deps): bump serialize-javascript, @rollup/plugin-terser and mocha
Closed 12 days ago
kurkle/chartjs-plugin-gradient #277
npm:mocha npm:serialize-javascript, @rollup/plugin-terser
kurkle
Bump serialize-javascript and mocha in /packages/vscode-extension
Closed 12 days ago
oracle/netsuite-suitecloud-sdk #1152
npm:mocha npm:serialize-javascript
oracle
Bump serialize-javascript and mocha
Closed 12 days ago
yo35/kokopu #71
npm:mocha npm:serialize-javascript
yo35
chore(deps): bump serialize-javascript and mocha
Open 12 days ago
takase1121/notcached #29
npm:mocha npm:serialize-javascript
takase1121
deps: bump serialize-javascript and mocha
Open 12 days ago
neovim/node-client #552
npm:mocha npm:serialize-javascript
neovim
Bump the npm_and_yarn group across 1 directory with 2 updates
Closed 13 days ago
ykominami/fizz-buzz #122
npm:serialize-javascript npm:@humanfs/node
ykominami
chore: Bump serialize-javascript and mocha
Open 14 days ago
FlowFuse/device-agent #734
npm:mocha npm:Bump serialize-javascript
FlowFuse
chore(deps): bump serialize-javascript and @rollup/plugin-terser
Closed about 2 months ago
kinde-oss/kinde-auth-pkce-js #140
npm:serialize-javascript npm:@rollup/plugin-terser
kinde-oss
chore(deps): bump the version-updates-group group with 18 updates
Closed 3 months ago
yosuke-291/dependabot-grouped-security-poc #7
npm:axios npm:ws +16 more
yosuke-291
Bump the npm_and_yarn group across 1 directory with 10 updates
Closed 3 months ago
first5455/vibe-tournament-organization #55
npm:react-router npm:vite +4 more
first5455
build(deps): bump the npm_and_yarn group across 33 directories with 12 updates
Open 3 months ago
hashim21223445/angular #331
npm:webpack-dev-server npm:@angular/common +7 more
hashim21223445
build(deps): bump the npm_and_yarn group across 28 directories with 12 updates
Closed 3 months ago
hashim21223445/angular #327
npm:webpack-dev-server npm:@angular/common +7 more
hashim21223445
Bump serialize-javascript and workbox-build
Open 3 months ago
unixfy/alexwang.net #209
npm:serialize-javascript npm:workbox-build
unixfy
Bump serialize-javascript and css-minimizer-webpack-plugin
Closed 3 months ago
cpprefjp/kunai #168
npm:serialize-javascript npm:css-minimizer-webpack-plugin
cpprefjp
Bump serialize-javascript and workbox-build
Open 3 months ago
lordfpx/chinese-words #8
npm:serialize-javascript npm:workbox-build
lordfpx
chore(deps): bump the npm_and_yarn group across 18 directories with 13 updates
Closed 3 months ago
goodgollyholly/react-router #3
npm:undici npm:serialize-javascript +5 more
goodgollyholly
Advisory Details
Published: August 11, 2020 about 6 years ago
Updated: September 02, 2026 13 days ago
CVSS Score: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.60% 84th percentile
Source: Github
Classification: GENERAL
UUID: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4Y2MtZjUycC13Yzk0
PR Statistics
PR Status
Open 163 (38.9%)
Merged 0 (0.0%)
Closed 256 (61.1%)
Update Types
Major 612 (39.7%)
Minor 425 (27.6%)
Patch 454 (29.5%)