Impact
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions.
This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions.
If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Patches
This was patched in v2.1.1.
Impact
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions.
This vulnerability is not affected on Node.js environment since Node.js's implementation of
RegExp.prototype.toString()backslash-escapes all forward slashes in regular expressions.If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Patches
This was patched in v2.1.1.