CVE-2019-16769

Name	CVE-2019-16769
Description	The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-serialize-javascript (PTS)	bookworm	6.0.0-2+deb12u1	fixed
	trixie	6.0.2-1	fixed
	forky	7.1.2+~5.0.4-1	fixed
	sid	7.1.4+~5.0.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-serialize-javascript	source	(unstable)	(not affected)

Notes

- node-serialize-javascript <not-affected> (Fixed before initial upload to Debian)
https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx