CVE-2017-5941

Critical

Published: 09/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in the node-serialize package 0.0.4 for Node.js that allows arbitrary code execution. Untrusted data passed into the unserialize() function can be exploited by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

Risk Assessment

Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of the application and the organization's data.

Recommendation

It is recommended to update the node-serialize package to the latest version to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).