GHSA-f7wr-f2gj-v69x: 
JavaScript vulnerability analysis and mitigation

Summary

seroval writes a RegExp as a regular expression literal or a RegExp constructor call. In affected versions, the pattern and the flags in the output are read from properties that an own property on the value can replace, and the flags are written without checks. A RegExp that received such properties can put arbitrary code into the serialized output (CWE-94, CWE-79).

Details

These functions are affected:

• serialize, serializeAsync
• crossSerialize, crossSerializeAsync, crossSerializeStream
• the Serializer class
• compileJSON

fromJSON and fromCrossJSON are not affected: they rebuild the value with the RegExp constructor, which rejects invalid flags.

Impact

An application is affected only when it serializes a RegExp that has an own source or flags property set from untrusted data. Both are getter-only properties on RegExp.prototype, so plain assignment and Object.assign cannot set them. The application has to define the property itself, for example with Object.defineProperty, or wrap the RegExp in a Proxy. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.

Affected versions

<= 1.7.5

Patches

Fixed in 1.7.6. The pattern and the flags now come from the RegExp's internal state, which properties on the value cannot change.

Workarounds

If you cannot upgrade, do not define source or flags properties on a RegExp from untrusted data, and do not serialize a Proxy that wraps a RegExp.

References

• GHSA-f86p-h4j2-7qgj, the same class of issue for typed arrays