Description
The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.
While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().
Recommendation
Update the serialize-javascript package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.0.2
- Patched version(s): 7.0.3
References
Could your website be exposed too?
SmartScanner can check your website for Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
- Insecure serialization leading to RCE in serialize-javascript - CVE-2020-7660
- Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega - CVE-2025-27793
- mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated March 02, 2026