Description

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Remediation

References

https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd

Related Vulnerabilities

CVE-2022-45206 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2023-49371 Vulnerability in maven package com.ruoyi:ruoyi

CVE-2022-43420 Vulnerability in maven package org.jenkins-ci.plugins:contrast-continuous-application-security

CVE-2021-32808 Vulnerability in npm package ckeditor4

CVE-2022-28355 Vulnerability in maven package org.scala-js:scalajs-library_2.11

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory