Version
5.0.9
Environment info
One of the @vue/cli-service dependencies serialize-javascript 6.0.2 has vulnerebbilities raised by dependabot alerts.
The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.
The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3
Steps to reproduce
Enable dependabot alerts for the repository that uses @vue/cli-service latest version 5.0.9, once the repo is scanned, a high severity alert is raised Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
What is expected?
Have dependencies versions with no vulnerability
What is actually happening?
@vue/cli-service uses serialize-javascript version 6.0.2 which is vulnerable
Version
5.0.9
Environment info
Steps to reproduce
Enable dependabot alerts for the repository that uses @vue/cli-service latest version 5.0.9, once the repo is scanned, a high severity alert is raised
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()What is expected?
Have dependencies versions with no vulnerability
What is actually happening?
@vue/cli-service uses serialize-javascript version 6.0.2 which is vulnerable