Description

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Remediation

References

https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd

Related Vulnerabilities

CVE-2020-7609 Vulnerability in npm package node-rules

CVE-2023-38507 Vulnerability in npm package @strapi/plugin-users-permissions

CVE-2023-35150 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui

CVE-2023-29519 Vulnerability in maven package org.xwiki.platform:xwiki-platform-attachment-ui

CVE-2022-22984 Vulnerability in npm package snyk-sbt-plugin

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory