CVE-2019-16769

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-16769
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16769.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-16769
Aliases
Downstream
Related
Published
2019-12-05T19:15:15.180Z
Modified
2026-04-11T20:52:32.396652Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

References

Affected packages

Git / github.com/yahoo/serialize-javascript

Affected ranges

Type
GIT
Repo
https://github.com/yahoo/serialize-javascript
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
433fc9cafe375b3f376efd12730b226035c3ee3a
Database specific 
{
    "cpe": "cpe:2.3:a:verizon:serialize-javascript:*:*:*:*:*:node.js:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.1"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v1.9.1
v2.*
v2.0.0
v2.1.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-16769.json"