Vulnerability · Published Jun 1, 2020 · Assigned by snyk
CVE-2020-7660
High 8.1
In plain English
A high-severity security flaw in serialize-javascript. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.1High
Exploit odds (30 days)3.0%top 12.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | serialize-javascript | 3.1.0 | GHSA-hxcc-f52p-wc94 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | serialize-javascript | All versions prior to version 3.1.0 |