Most recent entries from all

cnvd-2017-01756

2026-10-07T10:46:00.335558+00:00

cnvd-2017-01756

EUVD-2026-73641

2026-10-07T10:46:00.335591+00:00

EUVD-2026-73641

fkie_cve-2017-5954

2026-10-07T10:46:00.335613+00:00

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

GHSA-mm62-wxc8-cf7m — Code Execution Through IIFE in serialize-to-js

2026-10-07T10:46:00.335642+00:00

Affected: npm: serialize-to-js

Affected versions of `serialize-to-js` may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).

## Proof of Concept ```js var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }" var serialize = require('serialize-to-js'); serialize.deserialize(payload); ```

## Recommendation

Update to version 1.0.0, or later, and review [this disclaimer](https://www.npmjs.com/package/serialize-to-js#deserialize) from the author.

gsd-2017-5954

2026-10-07T10:46:00.335671+00:00

gsd-2017-5954