Description
The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.
While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().
Recommendation
Update the serialize-javascript package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.0.2
- Patched version(s): 7.0.3
References
Could your website be exposed too?
SmartScanner can check your website for Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies - CVE-2026-97711
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega - CVE-2025-27793
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793
You might also like:
See something that needs correcting? Let us knowUpdated March 02, 2026