aswin1906/github-advisory-2019.csv huggingface dataset:
Signature Verification Bypass in jwt-simple
Advisory: GHSA-8v5f-hp78-jgxq
Published: 2019-06-06T15:30:33Z
Affected: package: ecosystem: npm
name: jwt-simple
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.3
cwe_ids: CWE-347
severity: HIGH

Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).


## Recommendation

Upgrade to version 0.5.3 or later.
Improper Neutralization of Wildcards or Matching Symbols
Advisory: GHSA-xggx-fx6w-v7ch
Aliases: CVE-2019-3802
Published: 2019-06-04T15:42:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.8
package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.1.8
database_specific: last_known_affected_version_range: <= 2.0.14
package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.22
cwe_ids: CWE-155
CWE-200
severity: MODERATE

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
Advisory: GHSA-38cg-gg9j-q9j9
Aliases: CVE-2019-3875
Published: 2019-06-27T17:25:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.keycloak:keycloak-core
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 6.0.1
cwe_ids: CWE-295
CWE-345
severity: MODERATE

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Command Injection in command-exists
Advisory: GHSA-cff4-rrq6-h78w
Published: 2019-06-03T17:31:26Z
Affected: package: ecosystem: npm
name: command-exists
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.4
cwe_ids: CWE-77
severity: CRITICAL

Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.


## Recommendation

Update to version 1.2.4 or later.
Sensitive Data Exposure in pem
Advisory: GHSA-pgcr-7wm4-mcv6
Published: 2019-06-04T15:42:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: pem
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.13.2
cwe_ids: CWE-200
severity: CRITICAL

Versions of `pem` before 1.13.2 expose sensitive data when the `readPkcs12` is used. 

The `readPkcs12` function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.



## Recommendation

Update to version 1.13.2 or later.
XML Entity Expansion in Pippo
Advisory: GHSA-hwcx-9p4j-7hwj
Aliases: CVE-2019-5442
Published: 2019-06-13T20:22:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: ro.pippo:pippo-jaxb
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.12.0
cwe_ids: CWE-776
severity: HIGH

XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
SQL Injection in typeorm
Advisory: GHSA-w7q7-vjp8-7jv4
Published: 2019-06-06T15:30:16Z
Affected: package: ecosystem: npm
name: typeorm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.15
cwe_ids: CWE-89
severity: HIGH

Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 0.1.15
Remote Code Execution in node-os-utils
Advisory: GHSA-j9f8-8h89-j69x
Published: 2019-06-11T16:16:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: node-os-utils
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-94
severity: HIGH

Versions of `node-os-utils` prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

Upgrade to version 1.1.0 or later.
RubyGems Escape sequence injection vulnerability in api response handling
Advisory: GHSA-3h4r-pjv6-cph9
Aliases: CVE-2019-8323
Published: 2019-06-20T16:05:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
cwe_ids: CWE-74
severity: HIGH

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
Argument Injection in Apache Geode server
Advisory: GHSA-p426-qw2p-v95v
Aliases: CVE-2017-15694
Published: 2019-06-26T01:09:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.geode:geode-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.0
cwe_ids: CWE-88
severity: MODERATE

When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.
express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Advisory: GHSA-c35v-qwqg-87jc
Published: 2019-06-06T15:32:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: express-basic-auth
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.7
cwe_ids: CWE-208
severity: LOW

Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.


## Recommendation

Upgrade to version 1.1.7 or later.
Denial of Service in js-yaml
Advisory: GHSA-2pr6-76vf-7546
Published: 2019-06-05T14:35:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: js-yaml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.13.0
cwe_ids: CWE-400
severity: MODERATE

Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.


## Recommendation

Upgrade to version 3.13.0.
Insufficiently Protected Credentials and Improper Authentication in Spring Security
Advisory: GHSA-v33x-prhc-gph5
Aliases: CVE-2019-11272
Published: 2019-06-27T17:24:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: Maven
name: org.springframework.security:spring-security-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.13
database_specific: last_known_affected_version_range: <= 4.2.12
package: ecosystem: Maven
name: org.springframework.security:spring-security-cas
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.13.RELEASE
database_specific: last_known_affected_version_range: <= 4.2.12.RELEASE
cwe_ids: CWE-287
CWE-522
severity: HIGH

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.
TODO
Advisory: GHSA-22mf-97vh-x8rw
Aliases: CVE-2019-12760
Published: 2019-06-13T16:12:57Z
Withdrawn: 2019-07-03T16:48:55Z
Affected: package: ecosystem: PyPI
name: parso
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.4.0
severity: HIGH

** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution.  NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration."
Unauthorized File Access in harp
Advisory: GHSA-46hv-7769-j7rx
Aliases: CVE-2019-5437
Published: 2019-06-13T16:12:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: harp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.40.2
cwe_ids: CWE-548
severity: MODERATE

Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file.

## Recommendation

Upgrade to version `0.40.2` or later.
Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-h6ch-v84p-w6p9
Published: 2019-06-13T18:58:54Z
Affected: package: ecosystem: npm
name: diff
ecosystem_specific: affected_functions: diff.parsePatch
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.5.0
cwe_ids: CWE-400
severity: HIGH

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Regular Expression Denial of Service in braces
Advisory: GHSA-g95f-p29q-9xw4
Published: 2019-06-06T15:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: braces
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.1
cwe_ids: CWE-185
CWE-400
severity: LOW

Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 2.3.1 or higher.
Denial of Service in url-relative
Advisory: GHSA-86p3-4gfq-38f2
Published: 2019-06-05T14:10:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: url-relative
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
cwe_ids: CWE-400
severity: MODERATE

All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
SQL Injection in sql
Advisory: GHSA-8f93-rv4p-x4jw
Published: 2019-06-12T16:36:52Z
Affected: package: ecosystem: npm
name: sql
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.78.0
cwe_ids: CWE-89
severity: MODERATE

All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Cross-site Scriptin in JSPWiki
Advisory: GHSA-hp5r-mhgp-56c9
Aliases: CVE-2019-10078
Published: 2019-06-06T15:29:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
cwe_ids: CWE-79
severity: MODERATE

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Path Traversal in servey
Advisory: GHSA-rv49-54qp-fw42
Published: 2019-06-06T15:30:20Z
Affected: package: ecosystem: npm
name: servey
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.0
cwe_ids: CWE-22
severity: MODERATE

Versions of `servey` prior to 3.x are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to the latest version
ircdkit vulnerable to Denial of Service due to unhandled connection end event
Advisory: GHSA-f7r3-p866-q9qr
Published: 2019-06-03T17:27:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: ircdkit
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.4
database_specific: last_known_affected_version_range: <= 1.0.3
cwe_ids: CWE-400
severity: LOW

Versions of `ircdkit` 1.0.3 and prior are vulnerable to a remote denial of service.


## Recommendation

Upgrade to version 1.0.4.
Out-of-bounds Read in byte
Advisory: GHSA-xm7f-x4wx-wmgv
Published: 2019-06-04T15:47:43Z
Affected: package: ecosystem: npm
name: byte
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.1
cwe_ids: CWE-125
severity: MODERATE

Versions of `byte` before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length



## Recommendation

Update to version 1.4.1 or later.
Django Cross-site Scripting in AdminURLFieldWidget
Advisory: GHSA-7rp2-fm2h-wchj
Aliases: CVE-2019-12308
Published: 2019-06-10T18:43:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.21
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.9
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.2
cwe_ids: CWE-79
severity: MODERATE

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Insecure Default Configuration in tesseract.js
Advisory: GHSA-83rx-c8cr-6j8q
Published: 2019-06-05T20:48:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: tesseract.js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.19
cwe_ids: CWE-829
severity: MODERATE

Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.


## Recommendation

Upgrade to version 1.0.19 or later.
Prototype Pollution in handlebars
Advisory: GHSA-w457-6q6x-cgp9
Aliases: CVE-2019-19919
Published: 2019-12-26T17:58:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: handlebars
ecosystem_specific: affected_functions: handlebars.compile
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.0
cwe_ids: CWE-1321
CWE-74
severity: CRITICAL

Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads.


## Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.
Low severity vulnerability that affects com.linecorp.armeria:armeria
Advisory: GHSA-24r8-fm9r-cpj2
Aliases: CVE-2019-16771
Published: 2019-12-05T18:40:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: com.linecorp.armeria:armeria
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.97.0
cwe_ids: CWE-113
severity: LOW

## Multiple timing attack vulnerabilities leading to the recovery of secrets based on the use of non-constant time compare function

### Impact

String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method.

We would like to thank @chrsow for pointing out the issue.

## Potentially vulnerable codes

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54
https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64

### Patches

There are two options to patch this issue.

1. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method)

2. Use `MessageDigest.isEqual` to compare the credential instead.

### Workarounds

1. Update to the latest version (TBD)

2-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves.

2-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`).

### References
- https://cwe.mitre.org/data/definitions/208.html
- https://security.stackexchange.com/questions/111040/should-i-worry-about-remote-timing-attacks-on-string-comparison

### Side Note

Since it is a theoretical attack, there is no PoC available from neither the vendor nor the security team.
Unrestricted file uploads in Contao
Advisory: GHSA-wjx8-cgrm-hh8p
Aliases: CVE-2019-19745
Published: 2019-12-17T22:53:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: contao/core-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.4.46
package: ecosystem: Packagist
name: contao/core-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.5.0
fixed: 4.8.6
cwe_ids: CWE-434
severity: HIGH

### Impact

A back end user with access to the form generator can upload arbitrary files and execute them on the server.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.

### References

https://contao.org/en/security-advisories/unrestricted-file-uploads

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Cross-Site Scripting in serialize-to-js
Advisory: GHSA-3fjq-93xj-3f3f
Aliases: CVE-2019-16772
Published: 2019-12-06T23:20:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: serialize-to-js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-79
severity: MODERATE

Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 3.0.1 or later.