Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin.
Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
yahoo:serialize-javascript
References 3
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2…
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2g-v5hg
https://github.com/yahoo/serialize-javascript/commit/2bdbaaff9cb8a4639135eb24cf…
https://github.com/yahoo/serialize-javascript/commit/2bdbaaff9cb8a4639135eb24cfcd383d3fefb534
https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.2
https://github.com/yahoo/serialize-javascript/releases/tag/v7.1.2