Description
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | serialize-javascript | All versions prior to version 3.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-38.el8 | RHSA-2020:2861, RHSA-2020:2796 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | serialize-javascript | < 3.1.0 | 3.1.0 | GHSA-hxcc-f52p-wc94 |
Advisories 4
- RHSA-2020:2861 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2796 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-0777 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024