Most recent entries from all

cnvd-2017-01756

EUVD-2026-73641

fkie_cve-2017-5954

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

GHSA-mm62-wxc8-cf7m — Code Execution Through IIFE in serialize-to-js

Affected: npm: serialize-to-js

Affected versions of `serialize-to-js` may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).

## Proof of Concept ```js var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }" var serialize = require('serialize-to-js'); serialize.deserialize(payload); ```

## Recommendation

Update to version 1.0.0, or later, and review [this disclaimer](https://www.npmjs.com/package/serialize-to-js#deserialize) from the author.

Most recent entries from all

cnvd-2017-01756

EUVD-2026-73641

fkie_cve-2017-5954

GHSA-mm62-wxc8-cf7m — Code Execution Through IIFE in serialize-to-js

gsd-2017-5954