Arbitrary Code Injection In "serialize-javascript" For "vue-server-renderer"

[dargmuesli]

Version

2.6.11

Reproduction link

https://app.snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-570062

Steps to reproduce

n/a

What is expected?

Remediation
Upgrade serialize-javascript to version 3.1.0 or higher.

What is actually happening?

n/a

[posva]

Thanks but this Is a dev dependency

[dargmuesli]

It's listed under dependencies though:

vue/packages/vue-server-renderer/package.json

Line 28 in fb589e6

"serialize-javascript": "^2.1.2",

🤔

[dargmuesli]

I'm not talking about vue, I'm talking about vue-server-renderer^^

[posva]

I see, thanks, now it makes more sense. I opened #11434
It wasn't clear from such a short robotic issue with so many n/a 😄

[dargmuesli]

I thought the title was large enough, sorry 😄