CVE-2019-16772

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
commenthol	serialize-to-js	>= < 3.0.1, < 3.0.1

References

https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3Patch, Third Party Advisory
https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3fThird Party Advisory
https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3Patch, Third Party Advisory
https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3fThird Party Advisory

Timeline

Published: Dec 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167749.8In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.CVE-2019-167756.5Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files o CVE-2019-167768.1Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the inte CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binar CVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this c CVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as b CVE-2019-16784.3A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Me CVE-2019-167805.4WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is CVE-2019-167815.4In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi CVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 CVE-2019-167847.8In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a soft CVE-2019-167857.5Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and he