CVE-2017-5954: Critical severity Serialize-to-js Project Serialize-to-js Node.js vulnerability
Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).
Proof of Concept js var payload = "{e: (function(){ eval('console.log(exploited)') })() }" var serialize = require('serialize-to-js'); serialize.deserialize(payload);
Recommendation
Update to version 1.0.0, or later, and review this disclaimer from the author.
Other sources
An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/serialize-to-jsto a version that resolves this vulnerability.Fixed in 1.0.0 - Upgrade
Upgrade
serialize-to-jsto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5954?
CVE-2017-5954 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2017-5954?
To mitigate CVE-2017-5954, update the 'serialize-to-js' package to version 1.0.0 or later.
Which versions of 'serialize-to-js' are affected by CVE-2017-5954?
CVE-2017-5954 affects 'serialize-to-js' versions prior to 1.0.0.
What type of vulnerability is CVE-2017-5954?
CVE-2017-5954 is a vulnerability that allows for arbitrary code execution through an Immediately Invoked Function Expression (IIFE).
Can I safely use older versions of 'serialize-to-js' in my projects after CVE-2017-5954?
Using older versions of 'serialize-to-js' is not safe after CVE-2017-5954, and it is highly recommended to upgrade to avoid security risks.