Description

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Remediation

References

https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd

Related Vulnerabilities

CVE-2023-34464 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web

CVE-2020-29455 Vulnerability in npm package liveaddress

CVE-2021-37712 Vulnerability in npm package tar

CVE-2023-40815 Vulnerability in maven package org.opencrx:opencrx-core-models

CVE-2021-27292 Vulnerability in npm package ua-parser-js

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory