serialize-javascript Cross-Site Scripting via Unescaped Script Tag

Executive Summary

serialize-javascript versions 7.0.1 to 7.1.2 have a cross-site scripting (XSS) flaw. Attackers can inject malicious scripts by exploiting unescaped </script> tags in serialized function source text. This occurs when an attacker controls a function's source via a spoofed toString() method, allowing them to break out of HTML script elements and inject live markup like img onerror handlers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting JavaScript serialization outputs for unescaped </script> tags or function source text. Check if serialize-javascript versions are below 7.1.3. Review server responses containing serialized functions for potential XSS vectors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in a victim's browser. If you use a vulnerable version of serialize-javascript in a web application, attackers could steal session cookies, perform actions on behalf of users, or deface websites. It primarily affects applications that serialize user-controlled functions and render the output in HTML contexts.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information (PHI) to unauthorized parties. Compliance risks include data breaches, loss of user trust, and potential fines under GDPR (up to 4% of global revenue) or HIPAA penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade serialize-javascript to version 7.1.3 or later. Review and sanitize all serialized function outputs to ensure proper escaping of </script> tags. Implement input validation for function source text to prevent spoofed toString() methods.

Useful 0 Not Useful 0