GHSA-5c6j-r48x-rmvq: serialize-javascript fixed in 7.0.3

GHSA-5c6j-r48x-rmvq PUBLISHED CVSS 8.100000381469727 HIGH

Record from GitHub Advisory Database · Published February 28, 2026

serialize-javascript is fixed in 7.0.3 (npm)

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
serialize-javascript	npm	7.0.3
gitlab-rails-ce-fips-18.1	Chainguard	18.1.6-r15
kubeflow-katib	Wolfi	0.19.0-r40, 0.19.0-r31
wazuh-dashboard-fips	Chainguard	4.14.8-r0, 4.14.7-r11
arangodb-3.11	Chainguard	3.11.14.5-r4
drupal-11.3	Chainguard	11.3.13-r3
opensearch-dashboards-3	Chainguard	3.5.0-r6
langfuse-3	Wolfi	3.155.1-r4
gitlab-rails-ce-19.1	Chainguard	19.1.7-r6
argo-workflows-4.0	Chainguard	4.0.4-r6
argo-workflows-3.7	Chainguard	3.7.13-r2
langfuse-2	Chainguard	2.95.12-r13

31 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
chainguard	gitlab-rails-ce-fips-18.1	0
wolfi	kubeflow-katib	0, 0
chainguard	wazuh-dashboard-fips	0, 0
chainguard	arangodb-3.11	0
chainguard	drupal-11.3	0
chainguard	opensearch-dashboards-3	0
wolfi	langfuse-3	0
chainguard	gitlab-rails-ce-19.1	0
chainguard	argo-workflows-4.0	0
chainguard	argo-workflows-3.7	0
npm	serialize-javascript	0
chainguard	langfuse-2	0
chainguard	gitlab-rails-ce-fips-19.2	0
chainguard	tileserver-gl	0
chainguard	opensearch-dashboards-2	0
wolfi	argo-workflows-4.0	0
chainguard	argo-workflows-3.6	0
chainguard	opensearch-dashboards-2-fips	0
chainguard	gitlab-rails-ce-fips-18.9	0
chainguard	opensearch-dashboards-3-fips	0

…and 23 more

Timeline

Feb 28, 2026 CVE Published
Mar 2, 2026 CVE Updated
Oct 31, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-5c6j-r48x-rmvq
vulnetix vdb fixes GHSA-5c6j-r48x-rmvq

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-5c6j-r48x-rmvq/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →