{"action":"Upgrade serialize-to-js to 3.0.1 or later.","affected":[{"fixed":"3.0.1","introduced":"0"}],"component":"serialize-to-js","cve_ids":["CVE-2019-16772"],"ecosystem":"npm","epss":0.00646,"exploited":false,"fixed_versions":["3.0.1"],"ghsa_id":"GHSA-3fjq-93xj-3f3f","id":"tcs_01M5KEX5VXEMR0A3NQV70VEN71","modified_at":"2026-07-08T06:00:32.942609251Z","published_at":"2019-12-06T23:20:26Z","references":["https://osv.dev/vulnerability/GHSA-3fjq-93xj-3f3f","https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f","https://nvd.nist.gov/vuln/detail/CVE-2019-16772","https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3","https://github.com/advisories/GHSA-3fjq-93xj-3f3f","https://www.npmjs.com/advisories/1429"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-3fjq-93xj-3f3f","url":"https://osv.dev/vulnerability/GHSA-3fjq-93xj-3f3f"}],"summary":"Cross-Site Scripting in serialize-to-js"}