Skip to main content
cve.nowby Sazabi
← npm
npmPackage

serialize-javascript

7 known vulnerabilities (3 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 3 medium, 3 low
Registry
npm

Advisories 7

  • Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

    Affected: fixed in 7.1.3.

  • serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

    Affected: fixed in 7.1.3.

  • Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

    Affected: from 7.1.1, fixed in 7.1.2.

  • CVE-2026-34043Medium 5.9

    Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

    Affected: from 5.0.0, fixed in 7.0.5.

  • CVE-2024-11831Medium 5.4

    Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

    Affected: from 6.0.0, fixed in 6.0.2.

  • serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

    Affected: fixed in 3.1.0.

  • CVE-2019-16769Medium 4.2

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    Affected: fixed in 2.1.1.