Summary

Dependabot alert #11 identifies a high-severity RCE vulnerability (CVSS 8.1) in serialize-javascript versions <= 7.0.2.

Vulnerability Details

• Package: serialize-javascript
• Ecosystem: npm
• Manifest: docs/docusaurus/package-lock.json
• Scope: transitive runtime dependency
• Advisory: GHSA-5c6j-r48x-rmvq
• CWE: CWE-96 (Static Code Injection)
• CVSS: 8.1 (High) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability is an incomplete fix for CVE-2020-7660. RegExp.flags and Date.prototype.toISOString() are interpolated without escaping, enabling code injection when serialized output is evaluated.

Fix

Update serialize-javascript to version 7.0.3 via npm audit fix or npm overrides in docs/docusaurus/package.json.

References

• GHSA-5c6j-r48x-rmvq
• https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3