Search results

[Security] XSS via unsanitized function body serialization — </script> injection

Status: Open.

#220 In yahoo/serialize-javascript;

· y0un9eee opened on May 28, 2026

Ad java script

Status: Open.

#212 In yahoo/serialize-javascript;

· rameshkumarchouhanr opened on Mar 23, 2026

Backport of GHSA-5c6j-r48x-rmvq to version 6

Status: Open.

#208 In yahoo/serialize-javascript;

· bjohansebas opened on Feb 28, 2026

space option isn't applied on function properties

Status: Open.

#195 In yahoo/serialize-javascript;

· JounQin opened on Jun 26, 2025

Serialize regexp to literal

Status: Open.

#182 In yahoo/serialize-javascript;

· fisker opened on Jun 26, 2024

Fails on native functions, like Number or String (SOLUTION INCLUDED)

Status: Open.

#179 In yahoo/serialize-javascript;

· TheJaredWilcurt opened on May 16, 2024

Is it deterministic?

Status: Open.

#163 In yahoo/serialize-javascript;

· jjangga0214 opened on Jun 14, 2023

Use Function Objects for deserialization, instead of eval

Status: Open.

#158 In yahoo/serialize-javascript;

· tornikeshavishvili opened on Jan 21, 2023

The regExp of IS_PURE_FUNCTION & IS_ARROW_FUNCTION seem to be extra???

Status: Open.

#147 In yahoo/serialize-javascript;

· zhtyytg opened on Aug 2, 2022

Error objects are serialized to {}

Status: Open.

#135 In yahoo/serialize-javascript;

· wujekbogdan opened on Dec 7, 2021

Bug when used an object with a function and a variable with a function and destructuring

Status: Open.

#118 In yahoo/serialize-javascript;

· leobastiani opened on May 1, 2021

key filter support?

Status: Open.

#117 In yahoo/serialize-javascript;

· undefined-moe opened on Apr 13, 2021