Skip to content
OpenAdvisories
Medium · 4.2 CVE-2019-16769 EUVD-2019-0792GHSA-h9rv-jmmf-4pgx

Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

Published Dec 5, 2019 · Updated Aug 5, 2024 · Assigned by GitHub_M

Vendor: yahoo Product: serialize-javascript Package: serialize-javascript Ecosystem: npm

Description

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Affected products

VendorProductAffectedFixed
yahoo serialize-javascript < 2.1.1 – < 2.1.1 2.1.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Service Mesh 1 servicemesh-grafana +1 6.4.3-11.el8 RHSA-2020:2796

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Manager Server Module 4.0 branch-network-formula 0.1.1580471316.1839544-3.10.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 image-sync-formula 0.1.1579102150.4716559-3.11.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 mgr-osad 4.0.11-3.9.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 patterns-suse-manager 4.0-9.10.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 prometheus-formula 0.1-4.7.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 pxe-default-image-sle15 4.0.1-20200305173027 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 pxe-formula 0.1.1580384994.6076a7e-3.11.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 py26-compat-salt 2016.11.10-10.11.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 python-susemanager-retail 1.0.1580471316.1839544-3.13.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 redstone-xmlrpc 1.1_20071120-0.11.3.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 salt-netapi-client 0.17.0-4.3.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacecmd 4.0.18-3.13.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-admin 4.0.9-3.6.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-backend 4.0.30-3.23.3 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-certs-tools 4.0.15-3.15.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-client-tools 4.0.12-3.13.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-java 4.0.31-3.23.1 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-search 4.0.9-3.11.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-setup 4.0.13-3.11.1 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-utils +1 4.0.16-3.15.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 spacewalk-web 4.0.19-3.18.3 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 subscription-matcher 0.25-3.3.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 susemanager 4.0.22-3.20.3 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 susemanager-docs_en +1 4.0-10.18.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 susemanager-schema 4.0.18-3.17.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 susemanager-sls 4.0.24-3.17.2 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 system-lock-formula 0.2-4.5.1 SUSE-SU-2020:0671-1
SUSE Manager Server Module 4.0 virtualization-host-formula 0.2-4.3.2 SUSE-SU-2020:0671-1
SUSE Manager Proxy Module 4.0 mgr-osad 4.0.11-3.9.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 patterns-suse-manager 4.0-9.10.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 spacecmd 4.0.18-3.13.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 spacewalk-backend 4.0.30-3.23.3 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 spacewalk-certs-tools 4.0.15-3.15.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 spacewalk-client-tools 4.0.12-3.13.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 spacewalk-web 4.0.19-3.18.3 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1
SUSE Manager Proxy Module 4.0 supportutils-plugin-susemanager-proxy +1 4.0.3-3.3.2 SUSE-SU-2020:0671-1, SUSE-RU-2020:0671-1

Affected packages

EcosystemPackageAffectedFixedRecord
npm serialize-javascript < 2.1.1 2.1.1 GHSA-h9rv-jmmf-4pgx

Advisories 5

References