CVE-2017-5954
CriticalSummary
An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).
Risk Assessment
Organizations may be exposed to arbitrary code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update the serialize-to-js package to the latest version to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).